@yugabytedb/meko-mcp 2.0.0 → 2.1.0

package/assets/skills/meko-mcp-tools-desktop/references/tools-overview.md

@@ -1,13 +1,13 @@
 # Complete Tool Catalog and Decision Tree
 
-**22 tools on Cloud Meko** (verified against `https://mcp.mekodata.ai/mcp`). Grouped: Memory (8), Conversation (6), Knowledge Base (1), Datapack (5), Artifacts (2), Observability (1).
+**23 tools on Cloud Meko** (verified against `https://mcp.mekodata.ai/mcp`). Grouped: Memory (8), Conversation (6), Knowledge Base (1), Datapack (5), Artifacts (2), Observability (1).
 
 ## Quick health check before using tools
 
 Before starting a session, verify that the Meko MCP tools are working:
 
-1. `memory_search(scope="read", query="test", agent_id="<your-session-agent-id>", conversation_id="<session-conversation-id>")` — Confirms memory subsystem is up. Use the `agent_id` and `conversation_id` from the SessionStart `additionalContext`. May fail with "connection already closed" — see `tools-troubleshooting.md`.
-2. `datapack_list(scope="read")` — Confirms Meko API connectivity. Returns the datapacks your token has access to.
+1. `memory_search(query="test", agent_id="<your-session-agent-id>", conversation_id="<session-conversation-id>")` — Confirms memory subsystem is up. Use the `agent_id` and `conversation_id` from the SessionStart `additionalContext`. May fail with "connection already closed" — see `tools-troubleshooting.md`.
+2. `datapack_list()` — Confirms Meko API connectivity. Returns the datapacks your token has access to.
 
 ## Decision tree: which tool do I need?
 
@@ -20,6 +20,7 @@ User wants to...
 │   ├── Store a fact/preference/entity? -----------> memory_add (write)
 │   ├── Store a full conversation (multi-turn)? ---> conversation_create + conversation_add_message (write)
 │   ├── Search past knowledge? --------------------> memory_search (read)
+│   ├── Share private memories with the team? -----> memory_promote (write; owner/maintainer only)
 │   └── Retrieve a past conversation? -------------> conversation_get (read)
 ├── Persist or retrieve a file?
 │   ├── Upload a generated file (report, CSV, PDF)? -> artifact_put (write)
@@ -32,58 +33,58 @@ Agent / knowledge-base lifecycle is managed **outside** the MCP surface — typi
 
 ## Knowledge Base Tools (1)
 
-| Tool | Scope | Purpose |
-|------|-------|---------|
-| `knowledgebase_search(scope, query, agent_id, conversation_id, datapack_id, limit=10)` | read | Semantic search across KB chunks. `datapack_id` is REQUIRED (no default). |
+| Tool | Purpose |
+|------|---------|
+| `knowledgebase_search(query, agent_id, conversation_id, datapack_id, limit=10)` | Semantic search across KB chunks. `datapack_id` is REQUIRED (no default). |
 
 ## Memory Tools (8)
 
-| Tool | Scope | Purpose |
-|------|-------|---------|
-| `memory_add(scope, text, agent_id, conversation_id, user_id=None, app_id=None, run_id=None, metadata=None, messages=None, datapack_id=None)` | write | Store fact/preference/entity as long-term memory |
-| `memory_search(scope, query, agent_id, conversation_id="", user_id=None, limit=10, datapack_id=None)` | read | Semantic search across memories + graph relations. `conversation_id` optional (omit or pass `""` for cross-conversation discovery). |
-| `memory_get_by_id(scope, memory_id, agent_id, conversation_id, datapack_id=None)` | read | Direct pgvector row lookup by UUID. Preferred over `memory_search` for exact-id verification. |
-| `memory_get_all(scope, agent_id, conversation_id, user_id=None, app_id=None, run_id=None, datapack_id=None)` | read | List all memories for agent |
-| `memory_update(scope, memory_id, text, agent_id, conversation_id, datapack_id=None)` | write | Overwrite memory text |
-| `memory_delete_by_id(scope, memory_id, agent_id, conversation_id, datapack_id=None)` | write | Delete a single memory |
-| `memory_delete_all(scope, agent_id, conversation_id, user_id=None, app_id=None, run_id=None, datapack_id=None)` | admin | Delete all memories for agent (destructive) |
-| `flush_pending_memory_candidates(scope, agent_id)` | read | **Deprecated.** Superseded by automatic extraction from posted turns — post substantive turns with `conversation_add_message` and the server extracts memories from them. Now returns a `deprecated` payload pointing at `conversation_add_message`; kept one release for backward compatibility. |
+| Tool | Purpose |
+|------|---------|
+| `memory_add(text, agent_id, conversation_id, user_id=None, app_id=None, run_id=None, metadata=None, messages=None, datapack_id=None)` | Store fact/preference/entity as long-term memory |
+| `memory_search(query, agent_id, conversation_id="", user_id=None, limit=10, datapack_id=None)` | Semantic search across memories + graph relations. `conversation_id` optional (omit or pass `""` for cross-conversation discovery). |
+| `memory_get_by_id(memory_id, agent_id, conversation_id, datapack_id=None)` | Direct pgvector row lookup by UUID. Preferred over `memory_search` for exact-id verification. |
+| `memory_get_all(agent_id, conversation_id, user_id=None, app_id=None, run_id=None, datapack_id=None)` | List all memories for agent |
+| `memory_update(memory_id, text, agent_id, conversation_id, datapack_id=None)` | Overwrite memory text |
+| `memory_delete_by_id(memory_id, agent_id, conversation_id, datapack_id=None)` | Delete a single memory |
+| `memory_delete_all(agent_id, conversation_id, user_id=None, app_id=None, run_id=None, datapack_id=None)` | Delete all memories for agent (destructive) |
+| `memory_promote(conversation_id, memory_ids, agent_id=None, datapack_id=None)` | Promote private memories into the datapack's shared knowledge base (moves them + graph context out of mem0, then evicts from mem0 — one-way). Owners/maintainers only; viewers/contributors get 403.
 
 ## Conversation Tools (6)
 
-| Tool | Scope | Purpose |
-|------|-------|---------|
-| `conversation_create(scope, agent_id, user_id=None, app_id=None, run_id=None, title=None, metadata=None, session_id="")` | write | Create conversation container (Langfuse session) |
-| `conversation_add_message(scope, conversation_id, agent_id, input, output=None, reasoning=None, metadata=None, seed=None, trace_id="")` | write | Add a message turn (Langfuse trace) |
-| `conversation_get(scope, conversation_id, agent_id, include_messages=False, limit=100, offset=0)` | read | Retrieve conversation, optionally with messages |
-| `conversation_list(scope, agent_id, conversation_id="", user_id=None, limit=20, offset=0)` | read | List conversations for agent. `conversation_id` optional (omit for browse). |
-| `conversation_update(scope, conversation_id, agent_id, title=None, metadata=None)` | write | Update title or metadata |
-| `conversation_delete(scope, conversation_id, agent_id)` | admin | Delete entire conversation (destructive) |
+| Tool | Purpose |
+|------|---------|
+| `conversation_create(agent_id, user_id=None, app_id=None, run_id=None, title=None, metadata=None, session_id="")` | Create conversation container (Langfuse session) |
+| `conversation_add_message(conversation_id, agent_id, input, output=None, reasoning=None, metadata=None, seed=None, trace_id="")` | Add a message turn (Langfuse trace) |
+| `conversation_get(conversation_id, agent_id, include_messages=False, limit=100, offset=0)` | Retrieve conversation, optionally with messages |
+| `conversation_list(agent_id=None, limit=20, offset=0, conversation_id="", datapack_id=None)` | List conversations for agent within a datapack. `datapack_id` (UUID) is optional — defaults to the pinned/tenant datapack; use `datapack_list` to look it up. `conversation_id` optional (omit for browse). |
+| `conversation_update(conversation_id, agent_id, title=None, metadata=None)` | Update title or metadata |
+| `conversation_delete(conversation_id, agent_id)` | Delete entire conversation (destructive) |
 
 ## Datapack Management Tools (5)
 
-| Tool | Scope | Purpose |
-|------|-------|---------|
-| `datapack_create(scope, name)` | write | Create new datapack |
-| `datapack_list(scope)` | read | List all datapacks |
-| `datapack_describe(scope, datapack_id, include_status=False)` | read | Describe datapack by UUID |
-| `datapack_update(scope, datapack_id, connection_string)` | write | Update connection string |
-| `datapack_delete(scope, datapack_id)` | admin | Delete datapack by UUID (irreversible) |
+| Tool | Purpose |
+|------|---------|
+| `datapack_create(name)` | Create new datapack |
+| `datapack_list()` | List all datapacks |
+| `datapack_describe(datapack_id, include_status=False)` | Describe datapack by UUID |
+| `datapack_update(datapack_id, name=None, description=None)` | Rename a datapack and/or update its description. Pass at least one of `name` / `description`. |
+| `datapack_delete(datapack_id)` | Delete datapack by UUID (irreversible) |
 
 ## Artifact Tools (2)
 
 Content-addressed blob store scoped to a datapack. Files < 1 MB go inline in the DB; files ≥ 1 MB go to S3. Identity is SHA-256 — uploading the same bytes twice returns the same `content_hash`. Free-tier artifacts expire after 30 days of inactivity; pro-tier artifacts have no TTL.
 
-| Tool | Scope | Purpose |
-|------|-------|---------|
-| `artifact_put(scope, filename, content_base64, content_type, conversation_id, datapack_id=None, agent_id=None)` | write | Upload a file to the datapack. Returns `{artifact_id, content_hash, filename, size_bytes, stored_in}`. Max 5 MiB (configurable via `MEKO_MAX_ARTIFACT_UPLOAD_BYTES`). |
-| `artifact_get(scope, content_hash, conversation_id, datapack_id=None, agent_id=None)` | read | Retrieve a file by SHA-256 hash. Small files return `content_base64` inline; large files (S3) are written to `~/.meko/artifacts/<hash>/<filename>` and `local_path` is returned. |
+| Tool | Purpose |
+|------|---------|
+| `artifact_put(filename, content_base64, content_type, conversation_id, datapack_id=None, agent_id=None)` | Upload a file to the datapack. Returns `{artifact_id, content_hash, filename, size_bytes, stored_in}`. Max 5 MiB (configurable via `MEKO_MAX_ARTIFACT_UPLOAD_BYTES`). |
+| `artifact_get(content_hash, conversation_id, datapack_id=None, agent_id=None)` | Retrieve a file by SHA-256 hash. Small files return `content_base64` inline; large files (S3) are written to `~/.meko/artifacts/<hash>/<filename>` and `local_path` is returned. |
 
 ## Observability Tools (1)
 
-| Tool | Scope | Purpose |
-|------|-------|---------|
-| `track_token_usage(scope, conversation_id, name, input_tokens=0, output_tokens=0, total_tokens=None, model=None, message_id=None, datapack_id=None)` | write | Record an LLM-cost GENERATION observation on the conversation's trace. Primarily called by first-party Meko services (e.g. inference_gateway) that know their LLM's exact token counts. Most end-agents (Cursor, Claude Desktop) don't have those counts at the MCP call layer, so this tool is rarely useful for third-party agents. |
+| Tool | Purpose |
+|------|---------|
+| `track_token_usage(conversation_id, name, input_tokens=0, output_tokens=0, total_tokens=None, model=None, message_id=None, datapack_id=None)` | Record an LLM-cost GENERATION observation on the conversation's trace. Primarily called by first-party Meko services (e.g. inference_gateway) that know their LLM's exact token counts. Most end-agents (Cursor, Claude Desktop) don't have those counts at the MCP call layer, so this tool is rarely useful for third-party agents. |
 
 ## Platform capabilities NOT exposed via MCP
 
@@ -102,4 +103,4 @@ For knowledge-base content on Cloud, the canonical path is **UI upload**: Datapa
 
 ## Common Parameter Patterns
 
-Every tool accepts `scope` as the first parameter. Memory and KB tools accept optional `datapack_id` to target a specific datapack. Memory and conversation tools require `agent_id` for namespace isolation (see `tools-agent-id-conventions.md`).
+Memory and KB tools accept optional `datapack_id` to target a specific datapack. Memory and conversation tools require `agent_id` for namespace isolation (see `tools-agent-id-conventions.md`).

package/assets/skills/meko-mcp-tools-desktop/references/tools-rag-workflow.md

@@ -16,7 +16,6 @@ creation and ingestion happen out of band — through the **Meko UI**
 
 ```
 knowledgebase_search(
-    scope="read",
     query="natural-language question",
     agent_id="claude_desktop",
     conversation_id="<uuid from conversation_create>",
@@ -24,7 +23,7 @@ knowledgebase_search(
     limit=10)
 ```
 
-Required: `scope`, `query`, `agent_id`, `conversation_id`, `datapack_id`.
+Required: `query`, `agent_id`, `conversation_id`, `datapack_id`.
 Unlike the memory tools, `datapack_id` has no default here — you must
 pass it explicitly. `agent_id` is **ignored for filtering** on this
 tool (KB results are team-shared on the datapack), but you still pass

package/assets/skills/meko-mcp-tools-desktop/references/tools-troubleshooting.md

@@ -7,7 +7,7 @@ These patterns are extracted from real agent sessions. Follow them to avoid wast
 1. **Never retry the identical failed call more than once.** If it fails twice with the same error, it's not transient — diagnose the cause.
 2. **Distinguish transient vs persistent failures.** "Connection already closed" is transient (retry once). "Permission denied" is persistent (stop, don't retry).
 3. **Don't guess parameters sequentially.** If a tool fails with one parameter format, don't try 4 variations. Check this skill's docs for the correct format first.
-4. **Use your session's `agent_id` consistently.** For Claude Desktop the default is `claude_desktop`; for cross-project common facts use `meko_agent`. Other clients use `<client>:<repo-basename>` (e.g. `claude_code:meko-mcp-server`). Use `agent_id="meko_agent"` deliberately on `memory_search`/`memory_get_all` only when you want the common bucket — empty string also resolves to `meko_agent`, not a cross-agent fan-out. Don't switch between forms mid-session.
+4. **Use your session's `agent_id` consistently on writes.** For Claude Desktop the default is `claude_desktop`; use `meko_agent` when writing cross-project facts. Other clients use `<client>:<repo-basename>` (e.g. `claude_code:meko-mcp-server`). Memory reads and `conversation_list` span all of this user's agents regardless of the value passed; `conversation_get` requires the creating agent's exact value.
 
 ---
 
@@ -26,20 +26,6 @@ These patterns are extracted from real agent sessions. Follow them to avoid wast
 
 ---
 
-## Scope parameter errors
-
-**Error:** `Insufficient scope: 'all'. This tool requires 'read' or higher.`
-
-The only valid scope values are: `"read"`, `"write"`, `"admin"`.
-
-- Use `"read"` for all read operations (default choice)
-- Use `"write"` for inserts, updates, creates, memory writes
-- Use `"admin"` only for destructive deletes
-
-**Never use:** `"all"`, `"readwrite"`, `"rw"`, or any other value.
-
----
-
 ## agent_id errors
 
 On the Cloud multi-tenant schema, `agent_id` is a TEXT column value — not a PostgreSQL identifier — so arbitrary strings are accepted.
@@ -54,7 +40,7 @@ Fix: always pass a concrete non-empty `agent_id`. For Claude Desktop use `agent_
 
 ### "My reads return fewer results than I expected"
 
-`memory_search` and `memory_get_all` filter strictly on your passed `agent_id`. A memory written by `claude-code:<slug-A>` is invisible to a search with `agent_id="cursor:<slug-B>"`. If you need a broader view, call repeatedly across the agent_ids you want to cover, or point the user at the UI's Memory Summary page (which shows every row regardless of agent_id).
+`memory_search` and `memory_get_all` do not filter by `agent_id`: one call returns this user's memories across every agent. If results seem thin, check the `datapack_id`, confirm the write landed, and remember that mem0 extraction can be lossy. `conversation_get` is agent-owned and requires the exact creating `agent_id`; `conversation_list` is not agent-filtered.
 
 ### "I'm seeing rows tagged with legacy agent_id values"
 
@@ -66,7 +52,7 @@ Pre-existing data may be tagged `"agent"`, `"claude_code"`, `"cursor:<slug>"`, o
 
 | Tool | Safe to retry? | Why |
 |------|---------------|-----|
-| All `read` scope tools | Yes | Reads are idempotent |
+| All read-only tools | Yes | Reads are idempotent |
 | `memory_add` | Yes (once) | Mem0 has dedup logic |
 | `memory_update` | Yes (once) | Overwrites same ID |
 | `memory_delete_by_id` | Yes | Deleting already-deleted is a no-op |

package/assets/skills/meko-select-datapack-desktop/SKILL.md

@@ -3,15 +3,15 @@ name: meko-select-datapack-desktop
 description: >-
   Lists the user's Meko datapacks, shows authorization, supports search and
   pagination, and pins one as the active datapack on Claude Desktop. Triggers
-  when the user says things like "switch datapack", "use datapack <name>",
-  "list my datapacks", "which datapack am I on", "pin <name>", or any request
+  when the user says things like "switch datapack", "use the Acme datapack",
+  "list my datapacks", "which datapack am I on", "pin Acme", or any request
   to change or inspect the active datapack. Persistence is via memory_add
   (Desktop has no SessionStart hook), so the pin survives across sessions
   until the user clears it.
 license: MIT
 metadata:
   author: Meko
-  version: "1.1.0"
+  version: "1.2.0"
   tags: meko, datapack, selection, project, claude-desktop, desktop
 ---
 
@@ -42,10 +42,10 @@ Trigger immediately on any of these signals:
 
 ## On every Meko-touching turn (not just when this skill triggers)
 
-Before issuing a Meko MCP write tool call (memory_add, db_run_write_query, conversation_add_message, etc.), if you don't already know the active pin from this turn's earlier work:
+Before issuing a Meko MCP write tool call (memory_add, conversation_add_message, artifact_put, etc.), if you don't already know the active pin from this turn's earlier work:
 
 ```
-memory_search(scope="read",
+memory_search(
               query="meko_active_datapack",
               agent_id="claude_desktop",
               conversation_id="<this conversation's id>",
@@ -61,7 +61,7 @@ This is once per turn, not once per call. Cache within the turn.
 ### 1. List
 
 Use a **temporary** conversation for browsing only. Call
-`conversation_create(scope="write", agent_id="claude_desktop", title="Claude
+`conversation_create(agent_id="claude_desktop", title="Claude
 Desktop datapack selection")` and use its returned ID for the read-only
 `datapack_list` below and for the pin `memory_add`/`memory_update` in step 4.
 
@@ -72,13 +72,20 @@ must flow through a *new* conversation created in the selected datapack — see
 step 5.
 
 ```
-datapack_list(scope="read", conversation_id="<this conversation's id>")
+datapack_list(conversation_id="<this conversation's id>")
 ```
 
 The response is an array; the fields you'll use are `datapack_id`,
-`datapack_name`, `created_at`, and `account_id`.
+`datapack_name`, `created_at`, `account_id`, and `grant`.
 
-If the response has zero entries, tell the user: *"You don't have any datapacks yet. Run `datapack_create(scope='admin', name='<name>')` to make one, or visit the Meko Cloud console."* Stop here.
+`grant` is the caller's actual authorization on the datapack — one of
+`"owner"`, `"maintainer"`, `"contributor"`, `"viewer"`. Display it verbatim in
+the Role column. Do not hardcode "Owner", do not invent or normalize the value
+(render `"maintainer"` as `maintainer`, not `Maintainer`). The deployed
+response is the source of truth — see `references/role-display-future.md` for
+the taxonomy.
+
+If the response has zero entries, tell the user: *"You don't have any datapacks yet. Run `datapack_create(name='<name>')` to make one, or visit the Meko Cloud console."* Stop here.
 
 If the response has exactly **one** entry, **auto-select it**. Print: *"Only one datapack: `<name>`. Auto-selecting. Run `meko-select-datapack-desktop` again with `clear` to unset."* Skip the table; jump to step 4 (persist) and step 5 (confirm).
 
@@ -89,19 +96,22 @@ For 2+ datapacks, render a numbered table. **Page size 10.** Default sort: `crea
 ```
 Your datapacks (showing 1-10 of 14):
 
-#   Name                                   Role    Created       Status     Active?
-1   meko-local-setup                       Owner   2026-04-30    ready       ←  (pinned)
-2   meko_default_datapack                  Owner   2026-04-30    ready
-3   prod-research                          Owner   2026-04-12    ready
+#   Name                                   Role          Created       Status     Active?
+1   meko-local-setup                       owner         2026-04-30    ready       ←  (pinned)
+2   meko_default_datapack                  owner         2026-04-30    ready
+3   team-onboarding                        maintainer    2026-04-08    ready
+4   q2-roadmap                             viewer         2026-03-22    ready
 …
 
 Reply with: a number (1-10) to pin · a substring to search · `next` / `prev` to page
             · `clear` to unset · `cancel` to leave the current pin alone
-
-Note: Role is hardcoded to "Owner" today. Shared / Viewer / Contributor /
-Maintainer roles are pending upstream backend work — see references/role-display-future.md.
 ```
 
+The **Role** column shows each datapack's `grant` value verbatim (`owner`,
+`maintainer`, `contributor`, `viewer`). Never hardcode "Owner" — shared
+datapacks legitimately carry other grants, and misreporting them (e.g. showing
+a `maintainer` grant as "Owner") misleads the user about their own access.
+
 Mark the currently-pinned row with `←  (pinned)` based on the `memory_search` result (if any).
 
 ### 3. Parse the user's reply
@@ -118,7 +128,7 @@ Mark the currently-pinned row with `←  (pinned)` based on the `memory_search`
 **On first pin (no existing pin memory):**
 
 ```
-memory_add(scope="write",
+memory_add(
            text="meko_active_datapack=<uuid> name=<name> selected_at=<iso8601>",
            agent_id="claude_desktop",
            conversation_id="<this conversation's id>",
@@ -130,7 +140,7 @@ Verify the write with `memory_search` (the standard Meko verify-after-write rule
 **On switch (existing pin memory found):**
 
 ```
-memory_update(scope="write",
+memory_update(
               memory_id="<existing pin id>",
               text="meko_active_datapack=<new uuid> name=<new name> selected_at=<iso8601>",
               agent_id="claude_desktop",
@@ -142,7 +152,7 @@ Always update — never `memory_add` a second pin. Two pin memories will produce
 **On clear:**
 
 ```
-memory_delete_by_id(scope="write",
+memory_delete_by_id(
                     memory_id="<existing pin id>",
                     agent_id="claude_desktop",
                     conversation_id="<this conversation's id>")
@@ -153,7 +163,7 @@ If `memory_search` returned no pin, there's nothing to delete — print *"No pin
 **Conversation transition after a clear (same rule as a switch).** The pin memory is now gone, but the session's current conversation still physically lives in the datapack that was pinned when it was created — a conversation cannot move to the default. You must pick exactly one of these; do not mix them:
 
 - **Option A — keep capturing to the current conversation this session.** It stays in its original (now-unpinned) datapack, so you must keep passing that **same old `datapack_id`** on its `conversation_add_message` calls — do NOT switch it to the default (that would fail). The clear only affects *new* sessions. Disclose: *"Pin cleared. This chat keeps saving to `<old datapack name>`; new chats will use the default datapack."*
-- **Option B — start default-datapack capture immediately.** Create a **new** conversation with no `datapack_id` (`conversation_create(scope="write", agent_id="claude_desktop")`) and post all subsequent turns there. Stop posting to the old conversation. Disclose: *"Pin cleared. Started a new chat context saving to the default datapack."*
+- **Option B — start default-datapack capture immediately.** Create a **new** conversation with no `datapack_id` (`conversation_create(agent_id="claude_desktop")`) and post all subsequent turns there. Stop posting to the old conversation. Disclose: *"Pin cleared. Started a new chat context saving to the default datapack."*
 
 Default to Option A (least disruptive) unless the user wants the switch to take effect right now. Either way, never send `datapack_id=default` to the pre-existing pinned conversation.
 
@@ -173,7 +183,7 @@ right `datapack_id` flows through automatically.
 **Then start a fresh conversation for capture in the selected datapack.** The
 temporary selection conversation from step 1 belongs to the datapack that was
 active when it was created and cannot be moved. For subsequent capture this
-session, call `conversation_create(scope="write", agent_id="claude_desktop",
+session, call `conversation_create(agent_id="claude_desktop",
 datapack_id="<the newly pinned uuid>", title="<topic>")` and post turns
 (`conversation_add_message`) to *that* conversation with the same
 `datapack_id`. Do not keep posting to the selection conversation — doing so

package/assets/skills/meko-select-datapack-desktop/references/cookbook.md

@@ -11,12 +11,12 @@ Concrete transcripts of the four flows the skill supports on Claude Desktop.
 > memory_search(query="meko_active_datapack", agent_id="claude_desktop", limit=1)
 [empty]
 
-> datapack_list(scope="read")
+> datapack_list()
 [14 entries returned, filtering by "prod-research"]
 
 One match: `prod-research`. Pinning.
 
-> memory_add(scope="write",
+> memory_add(
              text="meko_active_datapack=8b1c…f4a2 name=prod-research selected_at=2026-05-25T18:42:00Z",
              agent_id="claude_desktop",
              conversation_id="<conv-id>",
@@ -44,12 +44,12 @@ datapack_id flows through automatically.
 > memory_search(query="meko_active_datapack", agent_id="claude_desktop", limit=1)
 [returns id=mem_abc123, text="meko_active_datapack=8b1c…f4a2 name=prod-research …"]
 
-> datapack_list(scope="read")
+> datapack_list()
 [14 entries returned, filtering by "q2-roadmap-deck"]
 
 One match: `q2-roadmap-deck`. Switching pin.
 
-> memory_update(scope="write",
+> memory_update(
                 memory_id="mem_abc123",
                 text="meko_active_datapack=4c2e…a991 name=q2-roadmap-deck selected_at=2026-05-25T19:05:00Z",
                 agent_id="claude_desktop",
@@ -69,12 +69,12 @@ The `memory_update` is critical here — using `memory_add` again would create a
 > memory_search(query="meko_active_datapack", agent_id="claude_desktop", limit=1)
 [empty]
 
-> datapack_list(scope="read")
+> datapack_list()
 [1 entry returned]
 
 Only one datapack: `meko-local-setup`. Auto-selecting.
 
-> memory_add(scope="write",
+> memory_add(
              text="meko_active_datapack=a17d…cc91 name=meko-local-setup selected_at=…",
              agent_id="claude_desktop",
              conversation_id="<conv-id>",
@@ -93,7 +93,7 @@ Pinned datapack `meko-local-setup` (`a17d…cc91`). Run this skill again with
 > memory_search(query="meko_active_datapack", agent_id="claude_desktop", limit=1)
 [returns id=mem_abc123]
 
-> memory_delete_by_id(scope="write",
+> memory_delete_by_id(
                       memory_id="mem_abc123",
                       agent_id="claude_desktop",
                       conversation_id="<conv-id>")
@@ -114,7 +114,7 @@ This isn't a user-triggered flow — it's the per-turn lookup the skill teaches
 
 # Extract UUID after "meko_active_datapack=" → 8b1c…f4a2
 
-> memory_add(scope="write", text="…", datapack_id="8b1c…f4a2",
+> memory_add(text="…", datapack_id="8b1c…f4a2",
              agent_id="claude_desktop", conversation_id="<conv-id>")
 ```
 

package/assets/skills/meko-select-datapack-desktop/references/role-display-future.md

@@ -0,0 +1,41 @@
+# Role display — current state
+
+## Today: render `grant` verbatim
+
+The deployed Meko `GET /datapacks` response includes a `grant` field on every datapack. Possible values (per maintainer guidance, 2026-05-26):
+
+- `"owner"` — datapacks the caller created.
+- `"maintainer"` — write access to a shared datapack including memories AND collective learnings/knowledge.
+- `"contributor"` — write access to a shared datapack: can generate own memories. (Cannot promote / publish collective learnings — that's the maintainer's job.)
+- `"viewer"` — read-only on a shared datapack.
+
+Use the field directly in the **Role** column:
+
+```
+#   Name                  Role          Created       Active?
+1   prod-research         owner         2026-04-12    ←  (pinned)
+2   team-onboarding       contributor   2026-04-08
+3   q2-roadmap            viewer        2026-03-22
+```
+
+Do not invent values, do not normalize the casing, do not display `"Owner"` if the field says `"owner"`. The deployed schema is the source of truth.
+
+Note that the upstream Go source (the `Datapack` struct in `api_server/internal/models/models.go` of the `meko` API-server repo) does NOT declare `grant` — the deployed server enriches the response beyond what the public Go code lists. Don't rely on the public struct for the wire schema; trust the actual response.
+
+## Other fields the live response includes
+
+Beyond the columns the skill renders by default, `datapack_list` returns counts that may be useful in some flows:
+
+- `memory_count` — total memories the caller has under this datapack (per `(user_id, agent_id)` scoping).
+- `knowledge_count` — knowledge-base entries on the datapack.
+- `learnings_count` — promoted-to-shared memories on the datapack.
+
+These aren't in the spec column set. Don't add them silently. If the user asks for counts, render them on request — and read the numbers from the live response, never invent them.
+
+## Sharing UI vs API state
+
+The Cloud console "Share <datapack>" page (`meko_ui/src/features/datapacks/pages/DatapackSharePage.tsx`) shows interactive controls with "Coming Soon" overlays on a few specific actions (e.g. invite-by-email link sharing, transfer-ownership). Those overlays mean *those specific UI affordances* aren't shipped — NOT that the underlying `grant`/sharing model is absent. Contributor/maintainer/viewer grants are functional in the data layer today; only the user-facing self-serve invite flow is gated.
+
+## Why the skill ships without Mine / Shared / All filter tabs
+
+The tagged pin memory (re-read via `memory_search` before each Meko write) delivers the user's actual ask ("don't make me remember a UUID"). Filter tabs are useful when the response is genuinely mixed-grant; for users with only owner-grant rows they're decorative. We add tabs when there's evidence users with mixed-grant responses want them.

package/assets/skills/meko-select-datapack-desktop/references/troubleshooting.md

@@ -40,7 +40,7 @@ The user has zero datapacks. Print:
 ```
 You don't have any datapacks yet. Create one with:
 
-  datapack_create(scope="admin", name="<your-datapack-name>")
+  datapack_create(name="<your-datapack-name>")
 
 Or visit the Meko Cloud console (Datapacks → New datapack).
 ```

package/bin/create-meko-setup.mjs

@@ -7,9 +7,14 @@ import { dirname, join } from 'node:path';
 
 import { install, uninstall } from '../lib/installer.mjs';
 import { askChoice, askMultiChoice, askText, askSecret, askYesNo, close as closePrompts } from '../lib/prompt.mjs';
-import { banner, error, dim, info } from '../lib/logger.mjs';
-import { isPackagedInstall, selfInvocation } from '../lib/clients/common.mjs';
+import { banner, error, dim, info, warn } from '../lib/logger.mjs';
+import {
+  isPackagedInstall,
+  MEKO_PRODUCTION_CONSOLE_URL,
+  selfInvocation,
+} from '../lib/clients/common.mjs';
 import { getClientAdapters } from '../lib/clients/index.mjs';
+import { resolveSuggestedMcpUrl } from '../lib/url-selection.mjs';
 import { parseClientList } from '../lib/clients/aliases.mjs';
 import { startMigration, runChildMigration, readStatus, stopMigration } from '../lib/migrate.mjs';
 import { checkLatest } from '../lib/version-check.mjs';
@@ -81,7 +86,7 @@ Examples:
   create-meko-setup
 
   # Cloud Meko for Claude Code (non-interactive):
-  create-meko-setup --url https://your-mcp.mekodev.com/mcp --api-key "$MEKO_API_KEY" --yes
+  create-meko-setup --url https://mcp.mekodata.ai/mcp --api-key "$MEKO_API_KEY" --yes
 
   # Local Meko with Cursor config:
   create-meko-setup --client cursor --local --scope project --yes
@@ -104,7 +109,7 @@ Options:
                         Comma-separated, or "all" to target every supported client (default: claude-code)
                         codex covers BOTH the OpenAI Codex CLI and the Codex Desktop App
                         (they share ~/.codex/config.toml).
-  --url <url>           MCP server URL (from app.mekodev.com > Datapacks > Connect)
+  --url <url>           MCP server URL (from cloud.mekodata.ai > Datapacks > Connect)
   --api-key <key>       API key for Cloud Meko authentication
   --local               Use local Meko at http://localhost:8000/mcp
   --scope <scope>       Config scope: user or project (default: user)
@@ -465,6 +470,28 @@ async function main() {
     }
   }
 
+  let suggestedUrl = null;
+  if (!url && !flags.local) {
+    suggestedUrl = resolveSuggestedMcpUrl({
+      adapters: getClientAdapters(),
+      clients,
+      name: flags.name,
+      scope: flags.scope,
+      projectRoot,
+    });
+    if (flags.yes) {
+      if (suggestedUrl.source === 'conflict') {
+        const conflicts = suggestedUrl.existingUrls.map((existingUrl) => `\n  - ${existingUrl}`).join('');
+        error(
+          `Selected clients have different existing Meko URLs:${conflicts}\n` +
+          'Pass --url explicitly to choose which endpoint to install.',
+        );
+        process.exit(1);
+      }
+      url = suggestedUrl.url;
+    }
+  }
+
   // Interactive mode: URL not provided and not auto-accepting defaults
   if (!url && !flags.yes) {
     banner('Meko Setup');
@@ -475,7 +502,7 @@ async function main() {
     // When only Cloud is available, skip the prompt entirely — asking to
     // pick between one option is pointless UX.
     const connectionOptions = [
-      { label: 'Cloud Meko', description: 'Hosted at mekodev.com (requires URL + API key)' },
+      { label: 'Cloud Meko', description: 'Hosted at mekodata.ai (requires an API key)' },
     ];
     if (!isPackagedInstall()) {
       connectionOptions.push({
@@ -490,7 +517,19 @@ async function main() {
 
     if (connectionType === 'Cloud Meko') {
       // Step 2 — MCP URL
-      url = await askText('MCP server URL (from app.mekodev.com > Datapacks > Connect):');
+      if (suggestedUrl?.source === 'existing') {
+        dim(`Using the existing Meko endpoint as the default: ${suggestedUrl.url}`);
+      } else if (suggestedUrl?.source === 'conflict') {
+        const conflicts = suggestedUrl.existingUrls.map((existingUrl) => `\n  - ${existingUrl}`).join('');
+        warn(
+          `Selected clients use different Meko endpoints:${conflicts}\n` +
+          'Enter the endpoint to use for this install.',
+        );
+      }
+      url = await askText(
+        `MCP server URL (from ${MEKO_PRODUCTION_CONSOLE_URL} > Datapacks > Connect):`,
+        suggestedUrl?.url ?? undefined,
+      );
 
       // Step 3 — API key. Normalize: terminal paste can drag in trailing
       // whitespace/CR or accidental surrounding quotes, all of which would

package/lib/clients/claude-code.mjs

@@ -288,13 +288,17 @@ export function createClaudeCodeAdapter(options = {}) {
       // leaving the marketplace.json missing. Full clone is small
       // (~few MB, mostly markdown) and is the only way that reliably
       // succeeds today.
-      // Marketplace source is normally the upstream GitHub repo. A dev/e2e
+      // Marketplace source is normally the public generated skills repo. Use
+      // an explicit HTTPS URL: GitHub's owner/repo shorthand makes Claude Code
+      // clone over SSH, which fails for users without GitHub SSH credentials.
+      // A dev/e2e
       // override lets a test install the plugin from a LOCAL working-tree
       // checkout (a directory path) so unreleased skill changes can be
-      // exercised end-to-end before they land on `yugabyte/meko-mcp-server`.
-      // Default is unchanged; only set MEKO_PLUGIN_MARKETPLACE_SOURCE in tests.
+      // exercised end-to-end before they are published to `yugabyte/meko-skills`.
+      // Only set MEKO_PLUGIN_MARKETPLACE_SOURCE in tests.
       const marketplaceSource =
-        process.env.MEKO_PLUGIN_MARKETPLACE_SOURCE || "yugabyte/meko-mcp-server";
+        process.env.MEKO_PLUGIN_MARKETPLACE_SOURCE
+        || "https://github.com/yugabyte/meko-skills.git";
       const marketplaceCmd =
         `claude plugin marketplace add ${shellQuote(marketplaceSource)} --scope ${shellQuote(scope)}`;
       // `claude plugin list` dropped --scope in CLI 2.1.x; it prints all

package/lib/clients/claude-desktop.mjs

@@ -99,9 +99,11 @@ export function createClaudeDesktopAdapter(options = {}) {
       const fromMcpb =
         /\bClaude\b[^ ]*\bExtensions\b/i.test(commandJoined) ||
         /mcp-remote-launcher\.js/.test(commandJoined);
+      const url = getMcpRemoteEntryUrl(entry);
       return {
         found: true,
         status: fromMcpb ? "Configured (via .mcpb extension)" : "Configured",
+        ...(url ? { url } : {}),
       };
     },
     removeRegistration(name) {
@@ -300,6 +302,18 @@ export function buildMcpRemoteEntry({ url, apiKey }) {
   return entry;
 }
 
+/** Read the remote URL from installer-managed or MCPB Claude Desktop entries. */
+export function getMcpRemoteEntryUrl(entry) {
+  if (typeof entry?.env?.MEKO_MCP_URL === "string") {
+    return entry.env.MEKO_MCP_URL;
+  }
+  if (typeof entry?.url === "string") return entry.url;
+  if (!Array.isArray(entry?.args)) return undefined;
+  const remoteIndex = entry.args.indexOf("mcp-remote");
+  const candidate = remoteIndex >= 0 ? entry.args[remoteIndex + 1] : undefined;
+  return typeof candidate === "string" ? candidate : undefined;
+}
+
 function defaultRunPackageScript(scriptPath) {
   if (!statSync(scriptPath).isFile()) {
     throw new Error(`Not a file: ${scriptPath}`);