@warmio/mcp 7.0.1 → 9.0.0

package/README.md

@@ -14,7 +14,7 @@ are stored separately and are never shared between modes.
 
 ## Requirements
 
-- Warm Pro
+- Any paid Warm plan (Plus or Pro)
 - A context key or an automation key from [Settings -> API Keys](https://warm.io/settings)
 - Node.js 18+
 
@@ -272,7 +272,20 @@ Latest response:
   "since": "2026-06-26",
   "window_days": 10,
   "count": 1,
-  "items": []
+  "items": [
+    {
+      "id": "txn_1",
+      "account_id": "acct_1",
+      "date": "2026-07-05",
+      "amount": 42.18,
+      "merchant": "Whole Foods",
+      "name": "WHOLE FOODS",
+      "category": "FOOD_AND_DRINK",
+      "subcategory": "FOOD_AND_DRINK_GROCERIES",
+      "pending": false,
+      "currency": "USD"
+    }
+  ]
 }
 ```
 
@@ -293,14 +306,6 @@ Returns:
 }
 ```
 
-## v7 Breaking Changes
-
-v7 is a clean pre-launch cutover with no backwards compatibility or alias window.
-
-- API keys are audience-bound: context keys cannot invoke actions and automation keys cannot run context mode.
-- `X-API-Key` is removed. Use `Authorization: Bearer`.
-- Automation is a separate opt-in MCP server mode, not extra tools on the context server.
-
 ## Security
 
 - Context mode is read-only and uses a context-only key.

package/dist/config-paths.d.ts

@@ -1,4 +1,4 @@
-export type WarmApiAudience = 'automation' | 'context';
+import { type PrivateMcpMode } from '@warmio/contracts/mcp';
 export declare function getWarmConfigDir(): string;
-export declare function getWarmApiKeyPath(audience?: WarmApiAudience): string;
+export declare function getWarmApiKeyPath(audience?: PrivateMcpMode): string;
 export declare function readConfigFile(configPath: string): string | null;

package/dist/config-paths.js

@@ -1,6 +1,7 @@
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import { WARM_MCP_CREDENTIALS } from '@warmio/contracts/mcp';
 export function getWarmConfigDir() {
     if (process.env.WARM_CONFIG_DIR?.trim()) {
         return process.env.WARM_CONFIG_DIR.trim();
@@ -17,12 +18,12 @@ export function getWarmConfigDir() {
     return path.join(os.homedir(), '.config', 'warm');
 }
 export function getWarmApiKeyPath(audience = 'context') {
-    const envKey = audience === 'automation' ? 'WARM_AUTOMATION_API_KEY_FILE' : 'WARM_CONTEXT_API_KEY_FILE';
-    const configuredPath = process.env[envKey]?.trim();
+    const credential = WARM_MCP_CREDENTIALS[audience];
+    const configuredPath = process.env[credential.apiKeyFileEnv]?.trim();
     if (configuredPath) {
         return configuredPath;
     }
-    return path.join(getWarmConfigDir(), `${audience}_api_key`);
+    return path.join(getWarmConfigDir(), credential.defaultFileName);
 }
 export function readConfigFile(configPath) {
     try {

package/dist/install.d.ts

@@ -1,7 +1,7 @@
-import { type WarmApiAudience } from './config-paths.js';
+import { type PrivateMcpMode } from '@warmio/contracts/mcp';
 export interface InstallOptions {
     force?: boolean;
-    mode?: WarmApiAudience;
+    mode?: PrivateMcpMode;
     validateApiKey?: boolean;
 }
 export declare function install(options?: InstallOptions): Promise<void>;

package/dist/install.js

@@ -2,6 +2,7 @@ import { createInterface } from 'readline';
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
 import { dirname, join, resolve } from 'path';
 import { homedir, platform } from 'os';
+import { WARM_MCP_CLIENTS, WARM_MCP_CREDENTIALS, WARM_MCP_PROJECT_CONFIGS, WARM_MCP_SERVER_CONFIGS, } from '@warmio/contracts/mcp';
 import { verifyWarmApiKey, WarmApiError } from './server.js';
 import { getWarmApiKeyPath, readConfigFile } from './config-paths.js';
 const HOME = homedir();
@@ -9,56 +10,50 @@ const CWD = process.cwd();
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
-function getClaudeDesktopPath() {
-    if (platform() === 'win32') {
-        return join(process.env.APPDATA || join(HOME, 'AppData', 'Roaming'), 'Claude', 'claude_desktop_config.json');
-    }
-    if (platform() === 'darwin') {
-        return join(HOME, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json');
-    }
-    return join(HOME, '.config', 'claude', 'claude_desktop_config.json');
-}
-const GLOBAL_CLIENTS = [
-    {
-        name: 'Claude Code',
-        configPath: join(HOME, '.claude.json'),
-        format: 'json',
-        alwaysInclude: true,
-    },
-    { name: 'Claude Desktop', configPath: getClaudeDesktopPath(), format: 'json' },
-    { name: 'Cursor', configPath: join(HOME, '.cursor', 'mcp.json'), format: 'json' },
-    {
-        name: 'Windsurf',
-        configPath: join(HOME, '.codeium', 'windsurf', 'mcp_config.json'),
-        format: 'json',
-    },
-    {
-        name: 'OpenCode',
-        configPath: join(HOME, '.config', 'opencode', 'opencode.json'),
-        format: 'json',
-    },
-    { name: 'Codex CLI', configPath: join(HOME, '.codex', 'config.toml'), format: 'toml' },
-    {
-        name: 'Antigravity',
-        configPath: join(HOME, '.gemini', 'antigravity', 'mcp_config.json'),
-        format: 'json',
-    },
-    { name: 'Gemini CLI', configPath: join(HOME, '.gemini', 'settings.json'), format: 'json' },
-];
-const PROJECT_CONFIGS = ['.mcp.json', '.cursor/mcp.json', '.vscode/mcp.json'];
-const MCP_PACKAGE_SPEC = '@warmio/mcp@latest';
+function resolveClientConfigPath(configPath) {
+    const root = configPath.root === 'appData' ? process.env.APPDATA || join(HOME, 'AppData', 'Roaming') : HOME;
+    return join(root, ...configPath.segments);
+}
+function getClientConfigPath(clientId) {
+    const client = WARM_MCP_CLIENTS.find((candidate) => candidate.id === clientId);
+    if (!client) {
+        throw new Error(`Unsupported MCP client: ${clientId}`);
+    }
+    const currentPlatform = platform();
+    const configPath = currentPlatform === 'darwin'
+        ? client.configPaths.darwin
+        : currentPlatform === 'win32'
+            ? client.configPaths.win32
+            : client.configPaths.linux;
+    return resolveClientConfigPath(configPath);
+}
+const GLOBAL_CLIENTS = WARM_MCP_CLIENTS.map((client) => ({
+    name: client.name,
+    format: client.format,
+    configPath: getClientConfigPath(client.id),
+    alwaysInclude: 'alwaysInclude' in client && client.alwaysInclude,
+}));
 function getServerName(mode) {
-    return mode === 'automation' ? 'warm-automation' : 'warm';
+    return WARM_MCP_SERVER_CONFIGS[mode].serverName;
+}
+function getCredential(mode) {
+    return WARM_MCP_CREDENTIALS[mode];
+}
+function getOppositeCredential(mode) {
+    return WARM_MCP_CREDENTIALS[mode === 'automation' ? 'context' : 'automation'];
 }
 function getMcpConfig(mode) {
-    const args = ['-y', MCP_PACKAGE_SPEC, 'mcp', '--mode', mode];
+    const serverConfig = WARM_MCP_SERVER_CONFIGS[mode];
     return platform() === 'win32'
-        ? { command: 'cmd', args: ['/c', 'npx', ...args] }
-        : { command: 'npx', args };
+        ? { command: 'cmd', args: ['/c', serverConfig.command, ...serverConfig.args] }
+        : { command: serverConfig.command, args: [...serverConfig.args] };
+}
+function formatTomlStringArray(values) {
+    return `[${values.map((value) => JSON.stringify(value)).join(', ')}]`;
 }
 function detectProjectClients() {
     const found = [];
-    for (const name of PROJECT_CONFIGS) {
+    for (const name of WARM_MCP_PROJECT_CONFIGS) {
         const configPath = resolve(CWD, name);
         if (existsSync(configPath)) {
             found.push({
@@ -97,18 +92,21 @@ function isSupportedWarmInvocation(command, args, mode) {
 }
 function getJsonEnvStatus(server, mode) {
     const env = isRecord(server?.env) ? server.env : undefined;
-    const apiKeyName = mode === 'automation' ? 'WARM_AUTOMATION_API_KEY' : 'WARM_CONTEXT_API_KEY';
-    const apiKeyFileName = `${apiKeyName}_FILE`;
-    const oppositeApiKeyName = mode === 'automation' ? 'WARM_CONTEXT_API_KEY' : 'WARM_AUTOMATION_API_KEY';
-    const inlineApiKey = typeof env?.[apiKeyName] === 'string' && env[apiKeyName].trim()
-        ? env[apiKeyName].trim()
-        : null;
+    const credential = getCredential(mode);
+    const oppositeCredential = getOppositeCredential(mode);
+    const apiKeyName = credential.apiKeyEnv;
+    const apiKeyFileName = credential.apiKeyFileEnv;
+    const inlineApiKey = typeof env?.[apiKeyName] === 'string' && env[apiKeyName].trim() ? env[apiKeyName].trim() : null;
     return {
         apiKeyFileOverride: typeof env?.[apiKeyFileName] === 'string' && env[apiKeyFileName].trim().length > 0
             ? env[apiKeyFileName].trim()
             : null,
-        hasIrrelevantCredential: ['WARM_API_KEY', 'WARM_API_KEY_FILE', oppositeApiKeyName, `${oppositeApiKeyName}_FILE`]
-            .some((name) => typeof env?.[name] === 'string' && env[name].trim().length > 0),
+        hasIrrelevantCredential: [
+            'WARM_API_KEY',
+            'WARM_API_KEY_FILE',
+            oppositeCredential.apiKeyEnv,
+            oppositeCredential.apiKeyFileEnv,
+        ].some((name) => typeof env?.[name] === 'string' && env[name].trim().length > 0),
         inlineApiKey,
     };
 }
@@ -196,19 +194,23 @@ function getTomlEnvStatus(content, mode) {
             inlineApiKey: null,
         };
     }
-    const envLines = envBlock.split(/\r?\n/).slice(1).filter((line) => line.trim().length > 0);
-    const apiKeyName = mode === 'automation' ? 'WARM_AUTOMATION_API_KEY' : 'WARM_CONTEXT_API_KEY';
-    const oppositeApiKeyName = mode === 'automation' ? 'WARM_CONTEXT_API_KEY' : 'WARM_AUTOMATION_API_KEY';
+    const envLines = envBlock
+        .split(/\r?\n/)
+        .slice(1)
+        .filter((line) => line.trim().length > 0);
+    const credential = getCredential(mode);
+    const oppositeCredential = getOppositeCredential(mode);
+    const apiKeyName = credential.apiKeyEnv;
     const inlineApiKey = getTomlStringValue(envBlock, apiKeyName)?.trim() || null;
-    const apiKeyFile = getTomlStringValue(envBlock, `${apiKeyName}_FILE`);
+    const apiKeyFile = getTomlStringValue(envBlock, credential.apiKeyFileEnv);
     return {
         apiKeyFileOverride: typeof apiKeyFile === 'string' && apiKeyFile.trim() ? apiKeyFile.trim() : null,
         envLines,
         hasIrrelevantCredential: [
             'WARM_API_KEY',
             'WARM_API_KEY_FILE',
-            oppositeApiKeyName,
-            `${oppositeApiKeyName}_FILE`,
+            oppositeCredential.apiKeyEnv,
+            oppositeCredential.apiKeyFileEnv,
         ].some((name) => Boolean(getTomlStringValue(envBlock, name)?.trim())),
         inlineApiKey,
     };
@@ -268,14 +270,15 @@ function configureJson(client, mode, preserveSelectedKeyFile) {
     const preserveProjectCommand = client.isProjectLevel &&
         !!existingCommand &&
         isSupportedWarmInvocation(existingCommand, existingArgs, mode);
-    const selectedKeyFile = mode === 'automation' ? 'WARM_AUTOMATION_API_KEY_FILE' : 'WARM_CONTEXT_API_KEY_FILE';
-    const oppositeKeyFile = mode === 'automation' ? 'WARM_CONTEXT_API_KEY_FILE' : 'WARM_AUTOMATION_API_KEY_FILE';
+    const credential = getCredential(mode);
+    const oppositeCredential = getOppositeCredential(mode);
+    const selectedKeyFile = credential.apiKeyFileEnv;
     for (const name of [
         'WARM_API_KEY',
         'WARM_API_KEY_FILE',
-        'WARM_CONTEXT_API_KEY',
-        'WARM_AUTOMATION_API_KEY',
-        oppositeKeyFile,
+        credential.apiKeyEnv,
+        oppositeCredential.apiKeyEnv,
+        oppositeCredential.apiKeyFileEnv,
     ]) {
         delete nextEnv[name];
     }
@@ -309,19 +312,21 @@ function configureToml(client, mode, preserveSelectedKeyFile) {
         }
     }
     const serverName = getServerName(mode);
-    const tomlCommand = platform() === 'win32' ? 'cmd' : 'npx';
-    const tomlArgs = platform() === 'win32'
-        ? `["/c", "npx", "-y", "${MCP_PACKAGE_SPEC}", "mcp", "--mode", "${mode}"]`
-        : `["-y", "${MCP_PACKAGE_SPEC}", "mcp", "--mode", "${mode}"]`;
+    const serverConfig = WARM_MCP_SERVER_CONFIGS[mode];
+    const tomlCommand = platform() === 'win32' ? 'cmd' : serverConfig.command;
+    const posixArgs = formatTomlStringArray(serverConfig.args);
+    const windowsArgs = formatTomlStringArray(['/c', serverConfig.command, ...serverConfig.args]);
+    const tomlArgs = platform() === 'win32' ? windowsArgs : posixArgs;
     const warmBlock = `[mcp_servers.${serverName}]${lineEnding}command = "${tomlCommand}"${lineEnding}args = ${tomlArgs}${lineEnding}`;
-    const selectedKeyFile = mode === 'automation' ? 'WARM_AUTOMATION_API_KEY_FILE' : 'WARM_CONTEXT_API_KEY_FILE';
-    const oppositeKeyFile = mode === 'automation' ? 'WARM_CONTEXT_API_KEY_FILE' : 'WARM_AUTOMATION_API_KEY_FILE';
+    const credential = getCredential(mode);
+    const oppositeCredential = getOppositeCredential(mode);
+    const selectedKeyFile = credential.apiKeyFileEnv;
     const removedEnvNames = new Set([
         'WARM_API_KEY',
         'WARM_API_KEY_FILE',
-        'WARM_CONTEXT_API_KEY',
-        'WARM_AUTOMATION_API_KEY',
-        oppositeKeyFile,
+        credential.apiKeyEnv,
+        oppositeCredential.apiKeyEnv,
+        oppositeCredential.apiKeyFileEnv,
         ...(!preserveSelectedKeyFile ? [selectedKeyFile] : []),
     ]);
     const preservedEnvLines = getTomlEnvStatus(content, mode).envLines.filter((line) => {
@@ -452,8 +457,7 @@ export async function install(options = {}) {
     }
     const apiKeyPath = getWarmApiKeyPath(mode);
     const storedApiKey = readConfigFile(apiKeyPath);
-    const migratedApiKey = needsSetup.find((status) => typeof status.inlineApiKey === 'string' && status.inlineApiKey.length > 0)
-        ?.inlineApiKey ?? null;
+    const migratedApiKey = needsSetup.find((status) => typeof status.inlineApiKey === 'string' && status.inlineApiKey.length > 0)?.inlineApiKey ?? null;
     const usableApiKeyFileOverride = needsSetup.find((status) => status.apiKeyFileOverride && !status.inlineApiKey && status.credentialApiKey);
     const targetMissingCredential = needsSetup.some((status) => !status.credentialApiKey);
     let apiKeyToStore = null;
@@ -472,7 +476,7 @@ export async function install(options = {}) {
             shouldStoreApiKey = true;
         }
         else if (usableApiKeyFileOverride && !targetMissingCredential) {
-            console.log(`  Reusing existing ${mode === 'automation' ? 'WARM_AUTOMATION_API_KEY_FILE' : 'WARM_CONTEXT_API_KEY_FILE'} override.`);
+            console.log(`  Reusing existing ${getCredential(mode).apiKeyFileEnv} override.`);
             console.log('');
         }
         else {