@usethrottle/mcp 0.4.1 → 0.4.2

package/README.md

@@ -67,12 +67,19 @@ than tools that fail when called.
 
 ## Writes
 
-This release is read-only against real data; sandbox seeding is the sole
-exception and is refused outright on a production credential.
+By default the server is read-only. Write tools register only when you start it
+with `--allow-writes`, and only those the key is scoped for:
 
-Write tools (quotes, refunds, subscription changes, webhook replay) land in the
-next release behind `--allow-writes`, with a second `--allow-live-writes` gate for
-production keys and an idempotency key on every call.
+`create_customer`, `update_customer`, `create_checkout_link`, `create_quote`,
+`send_quote`, `refund_payment`, `manage_subscription`, `cancel_subscription`,
+`replay_webhook_delivery`, `send_test_webhook`.
+
+On a production key they additionally need `--allow-live-writes`. Every write
+call carries an idempotency key, so a retried tool call never acts twice.
+`seed_test_data` is the one write that needs no flag, and it is refused outright
+on a production key.
+
+The hosted server at `mcp.usethrottle.dev` registers no write tools at all.
 
 ## Options
 
@@ -80,8 +87,8 @@ production keys and an idempotency key on every call.
 | --- | --- |
 | `--api-key <key>` | `THROTTLE_API_KEY` |
 | `--api <url>` | `THROTTLE_API_URL`, else `https://api.usethrottle.dev` |
-| `--allow-writes` | off (reserved for the write tools above) |
-| `--allow-live-writes` | off |
+| `--allow-writes` | off — registers the write tools above |
+| `--allow-live-writes` | off — also required for writes on a production key |
 
 A key belongs to one environment. To expose both production and a sandbox
 environment, add two server entries with different keys and distinct names.