@tempo-ai/mcp 0.0.104 → 0.0.105-staging.2

package/README.md

@@ -1,13 +1,34 @@
-# @tempo-ai/mcp
+# Tempo MCP
 
-Tempo's MCP server for external hosts — Claude Code, Codex CLI, Cursor, and
-any other MCP-compatible client. ONE server entry exposes Tempo's full tool
-surface: issues, cloud docs, canvas comments, custom agents, run scripts,
-Slack (as the org's Tempo bot), Linear, and — when run inside a Tempo repo —
-the canvas tools, including headless `canvas_screenshot` and `canvas_share`
-with real preview capture.
+Tempo ships **two** MCP surfaces. They expose the same underlying tools —
+pick by where your AI runs.
 
-## Install
+## Which one do I install?
+
+| Where your AI runs | Install this | What you get |
+| --- | --- | --- |
+| **A coding agent on your machine** — Claude Code, Codex CLI, Cursor, any stdio MCP host | **`@tempo-ai/mcp` (npm, local)** — see [Local package](#local-package-tempo-aimcp) | The FULL suite: issues, docs, comments, agents, scripts, Slack, Linear — reads **and writes** — plus canvas/design tools (screenshots, share links) when run inside a Tempo repo |
+| **A chat app in the browser or on mobile** — ChatGPT, claude.ai, Claude mobile, or any client that takes a remote MCP URL | **`https://mcp.tempo.new/mcp` (hosted)** — see [Hosted server](#hosted-server-mcptempobuild) | The DB-backed toolsets, reads **and writes**: issues, docs, comments, agents, scripts, Slack, Linear. No canvas/design tools (no filesystem there) |
+
+Rules of thumb:
+
+- If the client can run `npx`, use the **local package** — it's the full
+  experience.
+- If all you can give the client is a URL, use the **hosted server**.
+- Never configure both in one client; the hosted tools are a subset of the
+  local ones.
+
+---
+
+## Local package (`@tempo-ai/mcp`)
+
+One server entry exposes Tempo's full tool surface: issues, cloud docs,
+canvas comments, custom agents, run scripts, Slack (as the org's Tempo
+bot), Linear, and — when run inside a Tempo repo — the canvas tools,
+including headless `canvas_screenshot` and `canvas_share` with real
+preview capture.
+
+### Install
 
 Claude Code:
 
@@ -35,21 +56,12 @@ Sign in once (or let the first tool call prompt you):
 npx @tempo-ai/mcp login
 ```
 
-## Scoping model
-
-Identity comes from your sign-in; SCOPE is explicit on every call. Each
-issues/docs/comments/agents/scripts/slack/linear tool requires an `orgId`
-argument, and project-scoped tools require `projectId` — the AI discovers
-both with the built-in `tempo_list_orgs` / `tempo_list_projects` tools.
-Nothing org-related is ever baked into the connection config, and Tempo's
-backend re-validates org membership on every function call regardless.
-
-## Flags
+### Flags
 
 - `--toolsets issues,docs,canvas` — serve only the named toolsets
 - `--readonly` — register no write tools at all (also `TEMPO_MCP_READONLY=1`)
 
-## Canvas visuals
+### Canvas visuals
 
 `canvas_screenshot` / `canvas_share` spawn a disposable canvas devserver and
 capture with headless Chromium (the same pipeline Tempo's visual-review CI
@@ -60,3 +72,71 @@ npx playwright install chromium
 ```
 
 Share links require the canvas's branch to be committed and pushed.
+
+---
+
+## Hosted server (`mcp.tempo.new`)
+
+A remote MCP server (streamable HTTP + OAuth 2.1). You paste one URL, the
+client walks you through a Clerk sign-in consent, and every call runs as
+your Tempo account — reads and writes, with org membership re-validated
+server-side on every call. Only connect clients you trust: an authorized
+connector acts as you. Add `?readonly=1` to the URL for a connection that
+can never write.
+
+The URL for every client:
+
+```
+https://mcp.tempo.new/mcp
+```
+
+### ChatGPT (web)
+
+1. Enable connector development: Settings → **Apps & Connectors** →
+   **Advanced settings** → enable **Developer mode**.
+2. Settings → Apps & Connectors → **Create** (custom connector) → paste
+   `https://mcp.tempo.new/mcp`, authentication **OAuth**.
+3. Approve the Tempo sign-in consent when prompted.
+4. In a chat, enable the connector under **Plus → More → Developer mode**.
+
+Note: without Developer mode, ChatGPT connectors only run search-style
+deep-research tools; Developer mode unlocks full tool calling.
+
+### claude.ai (web) and Claude mobile
+
+1. Settings → **Connectors** → **Add custom connector**.
+2. Paste `https://mcp.tempo.new/mcp`, then complete the OAuth consent.
+
+### Claude Code / Cursor (remote instead of local)
+
+Prefer the local package (more tools). But the hosted URL also works:
+
+```bash
+claude mcp add --transport http tempo-hosted https://mcp.tempo.new/mcp
+```
+
+### Connection options
+
+- `?toolsets=issues,docs` — serve only the named toolsets (valid:
+  issues, docs, comments, agents, scripts, slack, linear)
+- `?readonly=1` — strict opt-down: write tools are never registered on
+  this connection, whatever else is configured
+
+### Scoping model (both surfaces)
+
+Identity comes from your sign-in; SCOPE is explicit on every call. Each
+tool requires an `orgId` argument (and `projectId` where project-scoped) —
+the AI discovers both with the built-in `tempo_list_orgs` /
+`tempo_list_projects` tools. Nothing org-related is ever baked into the
+connection config, and Tempo's backend re-validates org membership on
+every function call regardless.
+
+### Hosted architecture (maintainers)
+
+The endpoint lives in the `web-auth` Vercel deployable
+(`tempo-client/web-auth/api/mcp.ts` + rewrites) and instantiates the same
+factory modules as this package via `@tempo-modules/mcp-hosted`: Clerk
+OAuth token verified per request → 60s ES256 service JWT minted for
+Convex (additive `customJwt` provider in `auth.config.ts`) → stateless
+streamable HTTP, fresh server instance per POST. Ops runbook:
+`tempo-client/web-auth/CLAUDE.md` → "Hosted MCP".

package/dist/bin.js

@@ -2,7 +2,7 @@
 import { createRequire as __tempoCreateRequire } from 'node:module'; const require = __tempoCreateRequire(import.meta.url);
 import {
   run
-} from "./chunk-2MN4FILH.js";
+} from "./chunk-TK5FCMCH.js";
 import "./chunk-KFUOQZBJ.js";
 
 // src/bin.ts

package/dist/{call-5BVCQ6WY.js → call-O6MXQFN2.js}

@@ -8,7 +8,7 @@ import {
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
 async function connectAggregate(options) {
-  const { createTempoAggregate } = await import("./serve-FWQ5ZBR7.js");
+  const { createTempoAggregate } = await import("./serve-AGHNN3WQ.js");
   const handle = await createTempoAggregate(options);
   const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
   const client = new Client({ name: "tempo-mcp-cli", version: "0" });
@@ -127,4 +127,4 @@ export {
   runCall,
   runTools
 };
-//# sourceMappingURL=call-5BVCQ6WY.js.map
+//# sourceMappingURL=call-O6MXQFN2.js.map

package/dist/{chunk-2MN4FILH.js → chunk-TK5FCMCH.js}

@@ -157,7 +157,7 @@ async function run(argv) {
         process.stderr.write(USAGE);
         return 1;
       }
-      const { runServe } = await import("./serve-FWQ5ZBR7.js");
+      const { runServe } = await import("./serve-AGHNN3WQ.js");
       return await runServe(options);
     }
     switch (subcommand) {
@@ -172,11 +172,11 @@ async function run(argv) {
         return await runToken(rest);
       }
       case "tools": {
-        const { runTools } = await import("./call-5BVCQ6WY.js");
+        const { runTools } = await import("./call-O6MXQFN2.js");
         return await runTools(rest);
       }
       case "call": {
-        const { runCall } = await import("./call-5BVCQ6WY.js");
+        const { runCall } = await import("./call-O6MXQFN2.js");
         return await runCall(rest);
       }
       default:
@@ -195,4 +195,4 @@ async function run(argv) {
 export {
   run
 };
-//# sourceMappingURL=chunk-2MN4FILH.js.map
+//# sourceMappingURL=chunk-TK5FCMCH.js.map

package/dist/index.js

@@ -1,7 +1,7 @@
 import { createRequire as __tempoCreateRequire } from 'node:module'; const require = __tempoCreateRequire(import.meta.url);
 import {
   run
-} from "./chunk-2MN4FILH.js";
+} from "./chunk-TK5FCMCH.js";
 import "./chunk-KFUOQZBJ.js";
 export {
   run