@vantageos/vantage-registry-mcp 1.6.0 → 1.7.0

package/README.md

@@ -2,7 +2,7 @@
 
 MCP server exposing [VantageRegistry](https://github.com/elpiarthera/vantage-registry) Convex functions as Claude Code tools via stdio transport.
 
-**Version:** 1.1.1
+**Version:** 1.7.0
 **Backend:** Convex (vibrant-ibex-858)
 **Transport:** stdio (Claude Code MCP protocol)
 
@@ -229,10 +229,53 @@ Added optional `template_type` discriminator field:
 
 ---
 
+## ADMIN mode vs read-only mode (new in 1.7.0)
+
+The MCP server operates in one of two modes depending on token configuration:
+
+### ADMIN mode (write operations enabled)
+
+Requires **both** environment variables:
+
+```
+MCP_BEARER_TOKEN=<admin-token>       # HTTP transport only — identifies admin callers
+VR_ADMIN_WRITE_SECRET=<secret>       # backend write guard secret (from PR #93)
+```
+
+Write tools (`upsert_*`, `delete_*`, `register_component`, `update_component`,
+`link_runbook_template`, `unlink_runbook_template`) inject `adminSecret` into every Convex
+mutation call server-side. `adminSecret` is **never** exposed in tool input schemas — clients
+do not provide it.
+
+### Read-only mode (write operations refused)
+
+When the server is configured with `MCP_BEARER_TOKEN_READONLY` only (no admin token), all
+write tool calls are refused:
+- HTTP transport: returns `403 Forbidden` before the handler executes.
+- stdio transport: `adminWriteArgs()` throws immediately — zero mutations fired.
+
+A read-only instance cannot be made to write even if `VR_ADMIN_WRITE_SECRET` is present in
+its environment. The ADMIN mode gate is checked before the secret is injected.
+
+### Write tool list (all require ADMIN mode + VR_ADMIN_WRITE_SECRET)
+
+`upsert_team`, `upsert_agent`, `upsert_skill`, `upsert_skill_content`,
+`upsert_agent_content`, `upsert_plugin_content`, `upsert_hook_content`,
+`upsert_command_content`, `upsert_plugin`, `upsert_hook`, `upsert_prompt`,
+`upsert_template`, `upsert_test_run`, `upsert_skill_eval_corpus`,
+`upsert_runbook`, `delete_runbook`, `link_runbook_template`,
+`unlink_runbook_template`, `register_component`, `update_component`, `delete_component`
+
+### Read tool list (work in both modes, no secret required)
+
+All `list_*`, `get_*`, `detect_*`, `search_components`, `get_stats`.
+
+---
+
 ## Changelog
 
 See [CHANGELOG.md](../CHANGELOG.md) at the repo root.
 
 ---
 
-Orchestrator: Omega — VantageOS Team | 2026-05-19
+Orchestrator: Omega — VantageOS Team | 2026-06-14

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@vantageos/vantage-registry-mcp",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "MCP server exposing VantageRegistry Convex functions as Claude Code tools",
   "type": "module",
   "bin": {
-    "vantage-registry": "./server.ts"
+    "vantage-registry": "./server.js"
   },
   "scripts": {
     "build": "esbuild server.ts --bundle --platform=node --format=esm --outfile=server.js --external:convex --external:@modelcontextprotocol/sdk --external:zod --external:dotenv",