@wootsup/mcp 0.1.0 → 0.4.0

package/dist/uninstall-skill.d.ts

@@ -0,0 +1,27 @@
+export interface UninstallSkillOptions {
+    /** Skills dir holding the `apimapper/` folder. Default: ~/.claude/skills/ */
+    targetSkillsDir?: string;
+    /** AGENTS.md file the marker was appended to. Default: ~/AGENTS.md */
+    targetAgentsFile?: string;
+}
+export interface UninstallSkillResult {
+    skillRemoved: boolean;
+    markerRemoved: boolean;
+}
+/**
+ * Strip the install-skill marker block from AGENTS.md content.
+ *
+ * install-skill appends a block of the shape:
+ *
+ *   \n\n## API Mapper MCP\n\n<MARKER_LINE>\n<one descriptive line>\n
+ *
+ * We remove the `## API Mapper MCP` heading (and any leading blank lines
+ * before it) through the descriptive line that follows the marker. The match
+ * is anchored on MARKER_LINE so an edited heading still gets cleaned as long
+ * as the marker is intact. Returns the cleaned text, or `null` if no marker
+ * was present (caller treats that as "nothing removed").
+ */
+export declare function stripMarkerBlock(content: string): string | null;
+export declare function uninstallSkill(options?: UninstallSkillOptions): Promise<UninstallSkillResult>;
+/** True iff the skill dir is present (drives the default skill-removal prompt). */
+export declare function isSkillInstalled(targetSkillsDir?: string): boolean;

package/dist/uninstall-skill.js

@@ -0,0 +1,89 @@
+// src/uninstall-skill.ts — reverse of install-skill.ts.
+//
+// uninstallSkill() removes the copied skills/apimapper/ directory and strips
+// the marker block that install-skill appended to AGENTS.md. Idempotent: a
+// missing skill dir or absent marker is a clean no-op. Preserves every other
+// skill + all other AGENTS.md content.
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { MARKER_LINE } from "./install-skill.js";
+/**
+ * Strip the install-skill marker block from AGENTS.md content.
+ *
+ * install-skill appends a block of the shape:
+ *
+ *   \n\n## API Mapper MCP\n\n<MARKER_LINE>\n<one descriptive line>\n
+ *
+ * We remove the `## API Mapper MCP` heading (and any leading blank lines
+ * before it) through the descriptive line that follows the marker. The match
+ * is anchored on MARKER_LINE so an edited heading still gets cleaned as long
+ * as the marker is intact. Returns the cleaned text, or `null` if no marker
+ * was present (caller treats that as "nothing removed").
+ */
+export function stripMarkerBlock(content) {
+    if (!content.includes(MARKER_LINE))
+        return null;
+    const lines = content.split("\n");
+    const markerIdx = lines.findIndex((l) => l.trim() === MARKER_LINE.trim());
+    if (markerIdx === -1) {
+        // Marker present inline but not on its own line — fall back to a plain
+        // substring strip of the marker line itself.
+        return content.split(MARKER_LINE).join("");
+    }
+    // Walk backwards to include the `## API Mapper MCP` heading and the blank
+    // lines that separated it from the previous content.
+    let start = markerIdx;
+    // Skip a blank line directly above the marker (between heading and marker).
+    if (start > 0 && lines[start - 1].trim() === "")
+        start -= 1;
+    // Include the heading line if it is the install-skill heading.
+    if (start > 0 && lines[start - 1].trim() === "## API Mapper MCP")
+        start -= 1;
+    // Swallow leading blank separator lines above the heading.
+    while (start > 0 && lines[start - 1].trim() === "")
+        start -= 1;
+    // Walk forward to include the descriptive line(s) after the marker, up to
+    // the next blank line or EOF.
+    let end = markerIdx + 1;
+    while (end < lines.length && lines[end].trim() !== "")
+        end += 1;
+    const head = lines.slice(0, start);
+    const tail = lines.slice(end);
+    let next = [...head, ...tail].join("\n");
+    // Normalise: collapse a triple+ newline seam left by the excision and keep
+    // a single trailing newline if the original had one.
+    next = next.replace(/\n{3,}/g, "\n\n");
+    if (content.endsWith("\n") && next.length > 0 && !next.endsWith("\n")) {
+        next += "\n";
+    }
+    return next;
+}
+export async function uninstallSkill(options = {}) {
+    const targetSkillsDir = options.targetSkillsDir ?? join(homedir(), ".claude", "skills");
+    const targetAgentsFile = options.targetAgentsFile ?? join(homedir(), "AGENTS.md");
+    // 1. Remove the skill dir.
+    let skillRemoved = false;
+    const skillDir = join(targetSkillsDir, "apimapper");
+    if (existsSync(skillDir)) {
+        rmSync(skillDir, { recursive: true, force: true });
+        skillRemoved = true;
+    }
+    // 2. Strip the marker block from AGENTS.md (do NOT create it if absent).
+    let markerRemoved = false;
+    if (existsSync(targetAgentsFile)) {
+        const existing = readFileSync(targetAgentsFile, "utf8");
+        const stripped = stripMarkerBlock(existing);
+        if (stripped !== null) {
+            writeFileSync(targetAgentsFile, stripped, "utf8");
+            markerRemoved = true;
+        }
+    }
+    return { skillRemoved, markerRemoved };
+}
+/** True iff the skill dir is present (drives the default skill-removal prompt). */
+export function isSkillInstalled(targetSkillsDir) {
+    const dir = targetSkillsDir ?? join(homedir(), ".claude", "skills");
+    return existsSync(join(dir, "apimapper"));
+}
+//# sourceMappingURL=uninstall-skill.js.map

package/dist/uninstall-skill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uninstall-skill.js","sourceRoot":"","sources":["../src/uninstall-skill.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,uCAAuC;AAEvC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAcjD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,uEAAuE;QACvE,6CAA6C;QAC7C,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,0EAA0E;IAC1E,qDAAqD;IACrD,IAAI,KAAK,GAAG,SAAS,CAAC;IACtB,4EAA4E;IAC5E,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,KAAK,IAAI,CAAC,CAAC;IAC5D,+DAA+D;IAC/D,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,mBAAmB;QAAE,KAAK,IAAI,CAAC,CAAC;IAC7E,2DAA2D;IAC3D,OAAO,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,KAAK,IAAI,CAAC,CAAC;IAE/D,0EAA0E;IAC1E,8BAA8B;IAC9B,IAAI,GAAG,GAAG,SAAS,GAAG,CAAC,CAAC;IACxB,OAAO,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,GAAG,IAAI,CAAC,CAAC;IAEhE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,2EAA2E;IAC3E,qDAAqD;IACrD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,IAAI,IAAI,IAAI,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAiC,EAAE;IAEnC,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,gBAAgB,GACpB,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IAE3D,2BAA2B;IAC3B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,yEAAyE;IACzE,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,aAAa,CAAC,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAClD,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;AACzC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,eAAwB;IACvD,MAAM,GAAG,GAAG,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpE,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;AAC5C,CAAC"}

package/docs/architecture.md

@@ -11,17 +11,17 @@ internal plan-doc `~/Projekte/getimo/40-Plans/active/
    ┌──────────────────────────────────────────────────────────────┐
    │  AI client                                                   │
    │  (Claude Desktop · Claude Code · Cursor · VS Code · Cline · Codex CLI) │
-   └─────────────┬─────────────────────────────────┬──────────────┘
-                 │ stdio                            │ HTTP+OAuth2 PKCE
-                 │ (npx / DXT)                      │ (server-http.ts)
-                 ▼                                  ▼
+   └─────────────────────────────┬────────────────────────────────┘
+                                 │ stdio
+                                 │ (npx / DXT)
+                                 ▼
    ┌──────────────────────────────────────────────────────────────┐
    │  @wootsup/mcp (this package)                               │
    │                                                              │
    │  ┌──────────────┐  ┌──────────────┐  ┌──────────────────┐    │
    │  │ Transport    │→ │  Tool        │→ │  Platform router │    │
-   │  │  stdio /     │  │  registry    │  │  (WP / Joomla)   │    │
-   │  │  HTTP+OAuth  │  │  (~76 tools) │  │                  │    │
+   │  │  stdio        │  │  registry    │  │  (WP / Joomla)   │    │
+   │  │              │  │  (79 tools)  │  │                  │    │
    │  └──────────────┘  └──────────────┘  └──────────────────┘    │
    │           │              ▲                    │              │
    │           │              │                    │              │
@@ -54,11 +54,9 @@ internal plan-doc `~/Projekte/getimo/40-Plans/active/
 ## Five components
 
 1. **Transport layer** (`src/transports/`)
-   - `stdio.ts` — default; pipes JSON-RPC over stdin/stdout. Spawned
-     by the AI client.
-   - `http.ts` + `server-http.ts` — HTTP+SSE transport behind an
-     OAuth 2.0 PKCE-required authorization server. Bearer tokens are
-     site-bound; cross-origin requests are rejected.
+   - `stdio.ts` — the only transport. Pipes JSON-RPC over stdin/stdout.
+     Spawned by the AI client (npx / DXT). The server opens no network
+     listener.
 
 2. **Tool registry** (`src/modules/apimapper/`)
    - 15 register-files (connections, credentials, flows, graph,
@@ -86,7 +84,7 @@ internal plan-doc `~/Projekte/getimo/40-Plans/active/
 5. **Setup + skills** (`src/setup-cli.ts`, `skills/apimapper/`)
    - `@clack/prompts` interactive wizard.
    - Auto-detects AI clients, patches their MCP config idempotently.
-   - Ships the skill files (`SKILL.md` + 4 references) into
+   - Ships the skill files (`SKILL.md` + 9 reference docs) into
      `~/.claude/skills/apimapper/`.
 
 ## Auth flow (token issuance)
@@ -105,17 +103,19 @@ internal plan-doc `~/Projekte/getimo/40-Plans/active/
 At runtime, the server reads the token from the keychain on every
 launch — tokens never live in the client config file.
 
-## Multi-transport rationale
+## Transport rationale
 
-| | stdio | HTTP+OAuth |
-|---|---|---|
-| Where it runs | User's machine | User's machine or remote |
-| Auth | Bearer from keychain | OAuth 2.0 PKCE bound to site |
-| Use case | Local dev, single user | Remote AI agents (future) |
-| Discovery | Static (one-tool-set) | Dynamic per session |
+The MCP server ships **stdio-only**:
 
-Both paths feed the same tool registry; the only difference is the
-transport adapter wired into `createServer()`.
+| | stdio |
+|---|---|
+| Where it runs | User's machine |
+| Auth | Bearer (`amk_*`) from keychain / profile |
+| Use case | Local dev, single user |
+| Discovery | Static (one tool-set) |
+
+The AI client spawns the server as a child process and speaks JSON-RPC
+over stdin/stdout; there is no HTTP, SSE, or remote transport.
 
 ## Multi-platform rationale
 

package/docs/customgraph-internal-migration.md

@@ -99,10 +99,10 @@ then delete.
 
    ```bash
    npm view @wootsup/mcp version
-   # Expect: 0.1.0-rc.1 (or whatever the published tag was)
+   # Expect: 0.2.0 (rc.X-wN.M tail retired — plain semver now)
 
    npm view @wootsup/mcp dist-tags
-   # Expect: { latest: ..., rc: '0.1.0-rc.1' } for the rc tag
+   # Expect: latest now carries 0.2.0 (rc dist-tag track retired)
    ```
 
 3. **Run the setup wizard with the published package**
@@ -154,8 +154,8 @@ then delete.
    status: ok
    platform: wordpress (or joomla)
    site_url: https://dev.wootsup.com/wordpress
-   plugin_version: 2.0.7
-   tool_count: 74
+   plugin_version: 2.0.13
+   tool_count: 79
    ```
 
 8. **Run the full smoke suite**

package/docs/security.md

@@ -16,12 +16,12 @@ reporting process and supported-version policy, see
 | T6 | Confused-deputy LLM (read-only token gets `*_delete` tools listed) | High | Med | Scope filter excludes destructive tools from tool-list when the token lacks the scope. |
 | T7 | Local-fs token theft (no keychain) | Med | Med | `0600` file mode; keychain default on macOS/Windows; SECURITY.md warns about multi-user environments. |
 | T8 | DXT supply-chain (malicious .dxt) | Low | Critical | DXT bundle uploaded as a signed GitHub Release asset; `apimapper-mcp-publish.yml` workflow publishes with `--provenance`. |
-| T9 | OAuth callback hijack (HTTP transport) | Med | High | PKCE-required (S256); state param checked; loopback callback only. |
+| T9 | Network exposure of the MCP server | n/a | n/a | Not applicable — the server is stdio-only and opens no network listener. |
 | T10 | TOCTOU on rotate (old token works after rotate UI shows success) | Low | Med | Rotation is atomic on the server; the response shows the new token only after the old one is invalidated. |
 
 ## Token rotation
 
-- **From admin UI:** API Mapper → Connections → MCP Access → **Rotate**.
+- **From admin UI:** API Mapper → **⋮** menu → Settings → MCP Access → **Rotate**.
 - **From CLI:** `apimapper_credential_*` tools do **not** rotate MCP keys
   themselves — by design, key rotation is an admin-UI gesture (not a
   tool the LLM can call) to prevent confused-deputy rotation. Rotation
@@ -68,25 +68,6 @@ signing key. The user-visible site title (rendered by the wizard from
 the server's response, not the URL bar) gives one more verification
 surface for the user.
 
-## OAuth 2.0 PKCE (HTTP transport)
-
-When `@wootsup/mcp` runs in HTTP mode:
-
-- **Grants supported:** `authorization_code` with PKCE-S256 only.
-- **Implicit grant:** disabled.
-- **`code` grant without PKCE:** rejected with `invalid_request`.
-- **Loopback callbacks only:** `redirect_uri` must be
-  `http://127.0.0.1:<port>/callback` or `http://localhost:<port>/callback`.
-- **State param:** required and verified.
-- **Origin header:** Bearer tokens are bound to the issuing site URL.
-  A request from a different `Origin` is rejected (`401`).
-- **Token TTL:** 1 hour. Refresh tokens are not issued — the client
-  re-runs the auth flow.
-
-See `src/server-http.ts` for the implementation and
-`src/server-http.test.ts` (2 tests) + `src/transports/http.test.ts`
-(10 tests) for the pinning.
-
 ## Keychain fallback security
 
 When `@napi-rs/keyring` cannot reach an OS keychain:

package/docs/tools.md

@@ -1,24 +1,29 @@
 # Tools reference
 
-Auto-extracted from `src/modules/apimapper/*.ts` on **2026-05-18**.
+Auto-extracted from `src/modules/apimapper/*.ts` on **2026-06-03**.
 
 To regenerate after adding tools, run:
 
 ```bash
 cd packages/apimapper-mcp
-node scripts/extract-tools.mjs
+npm run build                              # ensure dist/ is fresh
+node scripts/extract-tool-descriptions.mjs # writes .grounding/tools-truth.json + a markdown table on stdout
 ```
 
-…and paste the `---MD---` output into the sections below. (The
-extractor is intentionally simple; a fully auto-generated build-step
-is tracked as a future improvement.)
+…and reconcile the sections below against the table. (The extractor
+boots a real `McpServer` and reads each tool's evaluated description —
+no source-text scraping. A fully auto-generated build-step is tracked
+as a future improvement.)
 
 ## Summary
 
-- **Total tools:** 77 registered (+ a few system surfaces brought in
+- **Total tools:** 79 registered (+ a few system surfaces brought in
   via `@getimo/mcp-toolkit`).
-- **Annotation breakdown:** 43 `readOnly`, 15 `mutating`, 10 `creating`,
-  6 `destructive`.
+- **Surface split:** 19 first-class in `tools/list` (15 module
+  essentials + the `apimapper_advanced` gateway + 3 top-level tools
+  registered in `index.ts`); the other 60 route through
+  `apimapper_advanced` so the listed surface stays under each client's
+  tool cap.
 
 The annotation tells the AI client what kind of side-effect each tool
 has. Destructive tools additionally require a `confirm: true`
@@ -30,7 +35,7 @@ vault) for the full convention.
 
 | Module | Tools | Notes |
 |---|---:|---|
-| `connections.ts` | 11 | CRUD + probe + sample-data + resources |
+| `connections.ts` | 12 | CRUD + probe + sample-data + resources + recover |
 | `flows.ts` | 11 | CRUD + compile + import/export + trace |
 | `library.ts` | 9 | Catalog + activate / deactivate templates |
 | `credentials.ts` | 7 | CRUD + link + OAuth begin |
@@ -42,11 +47,14 @@ vault) for the full convention.
 | `graph.ts` | 2 | Preview + validate |
 | `cache.ts` | 2 | Stats + invalidate |
 | `schema.ts` | 2 | Profile + snapshot list |
+| `gateway/advanced-tool.ts` | 1 | `apimapper_advanced` gateway to the 60 advanced tools |
+| `render/` | 1 | `apimapper_render` deterministic table/diagram/chart renderer |
+| `yootheme-binding.ts` | 1 | `apimapper_yootheme_binding_for_flow` source-name bridge |
 | `onboarding.ts` | 1 | Composite startup report |
 | `diagnose.ts` | 1 | Composite token + identity probe |
 | `inspect.ts` | 1 | Token decode (network-free) |
 | `get-skill.ts` | 1 | Read bundled skill doc |
-| `use-profile.ts` | 1 | Switch active profile |
+| `use-profile.ts` | 2 | Switch active profile + list profiles |
 | `index.ts` | 1 | `apimapper_rest_modules_status` |
 
 ### Adapter Status (`index.ts`)
@@ -55,6 +63,24 @@ vault) for the full convention.
 |------|------------|-------------|
 | `apimapper_rest_modules_status` | `readOnly` | Module-loading status for this MCP adapter (which sub-modules registered cleanly). |
 
+### Advanced Tool Gateway (`gateway/advanced-tool.ts`)
+
+| Tool | Annotation | Description |
+|------|------------|-------------|
+| `apimapper_advanced` | `creating` | Gateway to the 60 advanced tools. Call `{ tool }` for a target's schema + annotations (discovery), or `{ tool, arguments }` to run it. The target tool's own confirmation guards stay in effect. |
+
+### Render (`render/`)
+
+| Tool | Annotation | Description |
+|------|------------|-------------|
+| `apimapper_render` | `readOnly` | Render structured data as deterministic, pre-formatted text (tables, charts, flow-diagrams). Use when the user asks to visualize / show as a diagram / draw / display as a table or chart. |
+
+### YOOtheme Binding Bridge (`yootheme-binding.ts`)
+
+| Tool | Annotation | Description |
+|------|------------|-------------|
+| `apimapper_yootheme_binding_for_flow` | `readOnly` | Given a published flow ID, return the exact YOOtheme GraphQL source names (singular + List) and the schema fields available for binding. Replaces a multi-call chain. |
+
 ### Health, Releases, Brandfetch & Feedback (`misc.ts`)
 
 | Tool | Annotation | Description |
@@ -92,7 +118,8 @@ vault) for the full convention.
 | `apimapper_connection_get` | `readOnly` | Fetch full configuration of a single connection by ID. |
 | `apimapper_connection_health_check` | `readOnly` | Probe a set of connections in one batch and report status. May take 10-30s. |
 | `apimapper_connection_list` | `readOnly` | List all API Mapper connections. Use `apimapper_connection_get` for full details. |
-| `apimapper_connection_pipeline_update` | `mutating` | Update the connection's pipeline (endpoints, default_params, headers, items_path, items_shape). |
+| `apimapper_connection_pipeline_update` | `mutating` | Update the connection's pipeline (endpoints, default_params, default_headers, headers, items_path, items_shape, body, body_type, graphql_variables, response_type). |
+| `apimapper_connection_recover` | `mutating` | Recover a connection that is un-editable because its `params` field is corrupt (stored as a JSON-string with embedded UI metadata instead of an object). Resets `params` to a clean object. Has a `confirm` guard. |
 | `apimapper_connection_resources` | `readOnly` | List browseable resources on a connection (drive files, sheets, IG media). |
 | `apimapper_connection_test` | `readOnly` | Probe a connection's upstream endpoint to verify reachability + auth. |
 | `apimapper_connection_update` | `mutating` | Update fields on an existing connection. Only provided fields are changed; wire-format is snake_case. |
@@ -211,7 +238,8 @@ vault) for the full convention.
 
 | Tool | Annotation | Description |
 |------|------------|-------------|
-| `apimapper_use_profile` | `readOnly` | Activate a configured site profile and probe its identity endpoint to confirm the site is reachable and the plugin signature matches. |
+| `apimapper_list_profiles` | `readOnly` | List all configured site profiles (name, siteUrl, platform) with an `is_active` flag. Use to discover profile names before calling `apimapper_use_profile`. |
+| `apimapper_use_profile` | `mutating` | Activate a configured site profile and probe its identity endpoint to confirm the site is reachable and the plugin signature matches. |
 
 ## Convention reminders
 

package/manifest.json

@@ -1,85 +1,83 @@
 {
-  "dxt_version": "0.1",
-  "name": "@wootsup/mcp",
-  "display_name": "API Mapper for WordPress & Joomla",
-  "version": "0.1.0-rc.13-w3.1",
-  "description": "Build API integrations, OAuth credentials, and YOOtheme sources via natural conversation. Connects your AI assistant to API Mapper running on WordPress or Joomla.",
-  "author": {
-    "name": "WootsUp",
-    "url": "https://wootsup.com"
-  },
-  "homepage": "https://wootsup.com",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/wootsup/api-mapper"
-  },
-  "license": "MIT",
-  "keywords": [
-    "api-mapper",
-    "wordpress",
-    "joomla",
-    "yootheme",
-    "mcp",
-    "claude"
-  ],
-  "server": {
-    "type": "node",
-    "entry_point": "dist/index.js",
-    "mcp_config": {
-      "command": "node",
-      "args": [
-        "${__dirname}/dist/index.js"
-      ],
-      "env": {
-        "APIMAPPER_TOKEN": "${user_config.APIMAPPER_TOKEN}",
-        "APIMAPPER_SITE_URL": "${user_config.APIMAPPER_SITE_URL}",
-        "APIMAPPER_PLATFORM": "${user_config.APIMAPPER_PLATFORM}",
-        "APIMAPPER_PROFILE": "${user_config.APIMAPPER_PROFILE}"
-      }
-    }
-  },
-  "user_config": [
-    {
-      "key": "APIMAPPER_TOKEN",
-      "type": "string",
-      "title": "API Mapper MCP key",
-      "description": "Your amk_live_... key from API Mapper → Settings → MCP Keys",
-      "required": true,
-      "secret": true
-    },
-    {
-      "key": "APIMAPPER_SITE_URL",
-      "type": "string",
-      "title": "Site URL",
-      "description": "The base URL of your WordPress or Joomla site (e.g. https://example.com)",
-      "required": true
+    "dxt_version": "0.1",
+    "name": "@wootsup/mcp",
+    "display_name": "API Mapper for WordPress & Joomla",
+    "version": "0.4.0",
+    "description": "Build API integrations, OAuth credentials, and YOOtheme sources via natural conversation. Connects your AI assistant to API Mapper running on WordPress or Joomla.",
+    "icon": "icon.png",
+    "author": {
+        "name": "WootsUp",
+        "url": "https://wootsup.com"
     },
-    {
-      "key": "APIMAPPER_PLATFORM",
-      "type": "string",
-      "title": "Platform",
-      "description": "Either 'wordpress' or 'joomla'",
-      "required": true,
-      "default": "wordpress"
+    "homepage": "https://wootsup.com",
+    "documentation": "https://wootsup.com/docs/mcp",
+    "support": "https://wootsup.com/contact/",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/wootsup/api-mapper"
     },
-    {
-      "key": "APIMAPPER_PROFILE",
-      "type": "string",
-      "title": "Profile name",
-      "description": "Optional label for this site profile, used to switch between multiple sites via apimapper_use_profile. Defaults to 'default'.",
-      "required": false,
-      "default": "default"
-    }
-  ],
-  "compatibility": {
-    "claude_desktop": ">=0.10.0",
-    "platforms": [
-      "darwin",
-      "win32",
-      "linux"
+    "license": "MIT",
+    "keywords": [
+        "api-mapper",
+        "wordpress",
+        "joomla",
+        "yootheme",
+        "mcp",
+        "claude"
     ],
-    "runtimes": {
-      "node": ">=22.0.0"
+    "server": {
+        "type": "node",
+        "entry_point": "dist/index.js",
+        "mcp_config": {
+            "command": "node",
+            "args": [
+                "${__dirname}/dist/index.js"
+            ],
+            "env": {
+                "APIMAPPER_SITE_URL": "${user_config.APIMAPPER_SITE_URL}",
+                "APIMAPPER_TOKEN": "${user_config.APIMAPPER_TOKEN}",
+                "APIMAPPER_PROFILE": "${user_config.APIMAPPER_PROFILE}",
+                "APIMAPPER_SITES_FILE": "${user_config.APIMAPPER_SITES_FILE}"
+            }
+        }
+    },
+    "user_config": {
+        "APIMAPPER_SITE_URL": {
+            "type": "string",
+            "title": "Site URL",
+            "description": "Single-site setup: the base URL of your WordPress or Joomla site (e.g. https://example.com). Leave empty if you use the Sites file below.",
+            "required": false
+        },
+        "APIMAPPER_TOKEN": {
+            "type": "string",
+            "title": "API Mapper MCP key",
+            "description": "Single-site setup: your amk_live_... key from API Mapper → ⋮ menu → Settings → MCP Access. Leave empty if you use the Sites file below.",
+            "required": false,
+            "sensitive": true
+        },
+        "APIMAPPER_PROFILE": {
+            "type": "string",
+            "title": "Profile name (Optional for Single Site Configuration)",
+            "description": "Optional label for this site profile. Defaults to 'default'. With a Sites file, it selects which configured site is active; switch any time via apimapper_use_profile.",
+            "required": false,
+            "default": "default"
+        },
+        "APIMAPPER_SITES_FILE": {
+            "type": "string",
+            "title": "Sites file (for Multi-Site Configurations)",
+            "description": "Advanced / agency setups only: path to a sites.json that manages several sites from one install. Leave empty for a single site (use Site URL + key above). Normally populated by the setup wizard.",
+            "required": false
+        }
+    },
+    "compatibility": {
+        "claude_desktop": ">=0.10.0",
+        "platforms": [
+            "darwin",
+            "win32",
+            "linux"
+        ],
+        "runtimes": {
+            "node": ">=22.0.0"
+        }
     }
-  }
 }