@trusty-squire/mcp 1.0.1 → 1.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -7
- package/dist/bot/browser.js +1 -1
- package/dist/bot/browser.js.map +1 -1
- package/dist/bot/credential-text.js +1 -1
- package/dist/bot/credential-text.js.map +1 -1
- package/dist/bot/near-text-hint.js +8 -8
- package/dist/bot/near-text-hint.js.map +1 -1
- package/dist/bot/onboarding-capture.js +2 -2
- package/dist/bot/onboarding-capture.js.map +1 -1
- package/dist/install/cli.d.ts.map +1 -1
- package/dist/install/cli.js +10 -2
- package/dist/install/cli.js.map +1 -1
- package/dist/session.d.ts.map +1 -1
- package/dist/session.js +16 -4
- package/dist/session.js.map +1 -1
- package/dist/skill-registry-client.js +2 -2
- package/dist/skill-registry-client.js.map +1 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -73,15 +73,10 @@ A thin local MCP server that drives a real browser on your machine:
|
|
|
73
73
|
|
|
74
74
|
- **Browser:** real Chrome via Playwright + a stealth plugin, headed against an on-demand Xvfb on headless boxes (modern SaaS gate Chromium-headless).
|
|
75
75
|
- **OAuth-first:** takes the Google/GitHub OAuth path when offered; auto-approves only basic identity scopes (`openid`/`email`/`profile`), surfacing anything broader to you.
|
|
76
|
-
- **Email
|
|
76
|
+
- **Email verification:** reads the code or link from *your own* inbox via your signed-in browser, behind a just-in-time consent prompt — no shared aliases.
|
|
77
77
|
- **Captcha:** behavior simulation for invisible Turnstile / reCAPTCHA v3; click-and-wait for visible v2.
|
|
78
78
|
- **Write-only vault:** the raw secret is stored write-only and only ever *injected* server-side by the proxy — the agent never sees it.
|
|
79
79
|
|
|
80
|
-
## Pricing
|
|
81
|
-
|
|
82
|
-
- **Free** — provision, operate, store keys, personal use, 7-day audit, manual rotation.
|
|
83
|
-
- **Pro ($20/mo)** — egress grants for deployed apps, 365-day audit + export, automated rotation _(coming soon)_. Free while in beta.
|
|
84
|
-
|
|
85
80
|
## Configuration
|
|
86
81
|
|
|
87
82
|
No setup needed for normal use — `connect` wires everything up. Advanced bot
|
|
@@ -92,7 +87,7 @@ documented in [the repo](https://github.com/Trusty-Squire/trusty-squire).
|
|
|
92
87
|
|
|
93
88
|
- The bot **never** types into a Google/GitHub login form (it stops and returns `needs_login`), and never auto-approves OAuth scopes beyond basic identity.
|
|
94
89
|
- The MCP server runs on your machine; it does not phone home with traffic data.
|
|
95
|
-
-
|
|
90
|
+
- LLM proxy events auto-delete at 30 days; the vault audit trail at 365.
|
|
96
91
|
|
|
97
92
|
> **Developers note:** if you've cloned this repo, run `connect` from outside it (`cd ~` first). From inside `~/trusty-squire/apps/mcp/`, npm 10's npx mistakes the local workspace for the target and fails `sh: 1: mcp: not found`. End users don't hit this.
|
|
98
93
|
|
package/dist/bot/browser.js
CHANGED
|
@@ -565,7 +565,7 @@ export class BrowserController {
|
|
|
565
565
|
mouseX = 100;
|
|
566
566
|
mouseY = 100;
|
|
567
567
|
// Records the browser channel that .start() actually launched. Set
|
|
568
|
-
// post-launch so telemetry
|
|
568
|
+
// post-launch so telemetry can surface "this run
|
|
569
569
|
// used real Chrome" vs "this run used bundled Chromium." Useful for
|
|
570
570
|
// separating fingerprint regressions from network regressions when
|
|
571
571
|
// a service starts failing.
|