@statelyai/mcp 0.9.5 → 0.9.7

package/README.md

@@ -538,21 +538,21 @@ Tool errors carry a `code` from a closed set. An upstream `code` is only
 preserved when it is one of these values; anything else falls back to the
 default for the HTTP status class, so clients never see an invented code.
 
-| Code | Meaning |
-| --- | --- |
-| `bad_request` | Malformed request, and the default for unmapped 4xx statuses. |
-| `unauthenticated` | Missing or rejected credentials (HTTP 401). |
-| `forbidden` | Authenticated but not allowed (HTTP 403). |
-| `not_found` | No such project, machine, or route (HTTP 404). |
-| `conflict` | Version or state conflict (HTTP 409). |
-| `payload_too_large` | Upstream rejected the request size (HTTP 413). |
-| `rate_limited` | Too many requests (HTTP 429). |
-| `capability_disabled` | The operation is not enabled on this deployment. |
-| `upstream_error` | Server-side HTTP failure, and the default for 5xx statuses. |
-| `internal_error` | Unhandled failure inside a tool handler. |
-| `upstream_timeout` | The Stately API did not answer within `apiTimeoutMs`. |
-| `invalid_input` | Local input validation failed before any API call. |
-| `input_too_large` | Input exceeded `maxSourceBytes` before any API call. |
+| Code                  | Meaning                                                       |
+| --------------------- | ------------------------------------------------------------- |
+| `bad_request`         | Malformed request, and the default for unmapped 4xx statuses. |
+| `unauthenticated`     | Missing or rejected credentials (HTTP 401).                   |
+| `forbidden`           | Authenticated but not allowed (HTTP 403).                     |
+| `not_found`           | No such project, machine, or route (HTTP 404).                |
+| `conflict`            | Version or state conflict (HTTP 409).                         |
+| `payload_too_large`   | Upstream rejected the request size (HTTP 413).                |
+| `rate_limited`        | Too many requests (HTTP 429).                                 |
+| `capability_disabled` | The operation is not enabled on this deployment.              |
+| `upstream_error`      | Server-side HTTP failure, and the default for 5xx statuses.   |
+| `internal_error`      | Unhandled failure inside a tool handler.                      |
+| `upstream_timeout`    | The Stately API did not answer within `apiTimeoutMs`.         |
+| `invalid_input`       | Local input validation failed before any API call.            |
+| `input_too_large`     | Input exceeded `maxSourceBytes` before any API call.          |
 
 Migration: 4xx responses that previously surfaced an unrecognized upstream code
 verbatim (or `upstream_error` from a proxy) now report the status-class default
@@ -577,6 +577,9 @@ Self-host Stately Studio, then replace the hosted URL above with your
 deployment's `/api/mcp` endpoint, for example
 `https://studio.example.com/api/mcp`.
 
+When the editor runs with `AUTH_PROVIDER=none`, MCP tool calls do not require a
+bearer credential. Keep the endpoint behind your own trusted access boundary.
+
 After deployment, run the protocol and MCP App canary with a read-only bearer
 credential:
 
@@ -586,8 +589,9 @@ STATELY_MCP_CANARY_TOKEN=... pnpm verify:mcp:canary
 ```
 
 It verifies tool discovery, fetches and hashes the advertised app template,
-and runs a minimal visualization. The scheduled production workflow uses the
-`STATELY_MCP_CANARY_TOKEN` repository secret.
+checks compatibility URLs used by previously created visualizations, and runs
+a minimal visualization. The scheduled production workflow requires the
+`STATELY_MCP_CANARY_TOKEN` repository secret and fails when it is absent.
 
 For enterprise self-hosting options, [see pricing and contact
 us](https://stately.ai/pricing).