alora-mcp 0.7.0 → 0.8.0

package/README.md

@@ -26,13 +26,15 @@ Or in any MCP client's JSON config:
 }
 ```
 
-## Connect (once, takes a minute)
+## Connect (one email, one click)
 
-1. Create a free account at [alora.build/register](https://alora.build/register) — $0.50 of credit included, no card.
-2. Run `npx alora-cli connect` in your terminal — it prints a code.
-3. Paste the code at [alora.build/activate](https://alora.build/activate).
+Just ask your agent to set you up. It asks for your email and calls the `account_create_and_connect` tool — you get **a single email, and one click** creates your account ($0.50 of free credit included, no card), verifies it, and authorizes the agent. No password to invent; you log into the panel later with a magic link.
 
-The token lands in `~/.alora/config.json`, and from then on your agent takes it from here. Full playbook for agents: [alora.build/llms.txt](https://alora.build/llms.txt).
+Already have an account? The same flow sends you an authorize link instead — one click never creates or touches an existing account without you signing in.
+
+Prefer the classic way? Create an account at [alora.build/register](https://alora.build/register), run `npx alora-cli connect`, and paste the code at [alora.build/activate](https://alora.build/activate).
+
+Either way the token lands in `~/.alora/config.json`, and from then on your agent takes it from here. Full playbook for agents: [alora.build/llms.txt](https://alora.build/llms.txt).
 
 ## What your agent can do (45 tools)
 
@@ -45,6 +47,7 @@ The token lands in `~/.alora/config.json`, and from then on your agent takes it
 | **Configure** | `secrets_set` (encrypted, injected as env) · `domain_connect` · `egress_ip_allocate` (static egress IP) |
 | **Use AI inside the app** | `ai_enable` — the deployed app runs `claude -p` with the owner's own Claude account |
 | **Buy domains** | `domain_search` · `domain_buy` — always gated on the owner's approval by email |
+| **Be an MCP server** | your deployed app can expose its own `/mcp` endpoint, with per-customer tokens (`token_create`) and identity headers — an [MCP-first SaaS in one deploy](https://alora.build/blog/host-mcp-server) |
 | **Know what's happening** | `analytics_summary` · `analytics_users` · `wallet_balance` · `changelog` |
 
 ## How it behaves

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "alora-mcp",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "MCP server for Alora, the cloud where your agent works — deploy, preview, share and run the apps your agent writes. Claude Code, Codex, Cursor and any MCP client.",
   "type": "module",
   "bin": {
     "alora-mcp": "src/index.js"
   },
   "dependencies": {
-    "alora-sdk": "^0.7.0",
+    "alora-sdk": "^0.8.0",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "tar": "^7.4.3",
     "zod": "^3.24.0"

package/src/index.js

@@ -18,7 +18,7 @@ function client() {
   return new AloraClient({ api: cfg.api || 'https://api.alora.build', token: cfg.token });
 }
 
-const server = new McpServer({ name: 'alora', version: '0.7.0' });
+const server = new McpServer({ name: 'alora', version: '0.8.0' });
 
 const ok = (data) => ({ content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] });
 const asError = (e) => ({
@@ -151,9 +151,14 @@ server.registerTool('logs', {
 }, wrap(({ project, lines, since }) => client().logs(project, { lines, since })));
 
 server.registerTool('exec', {
-  description: 'Ejecuta un comando dentro de la microVM del proyecto (despierta la máquina si duerme). Devuelve stdout, stderr y exit_code. Para inspeccionar el filesystem, ver archivos en /data, debuggear. Ej: "ls -la /data", "cat /data/bitacora/hoy.log".',
-  inputSchema: { project: z.string(), command: z.string() },
-}, wrap(({ project, command }) => client().exec(project, command)));
+  description: 'Ejecuta dentro de la MISMA microVM donde corre la app (cwd /app; despierta la máquina si duerme). Devuelve stdout/stderr/exit_code. Dos modos: command (string, pasa por sh) o argv (array LITERAL sin shell — usalo para comandos con quoting complejo o multilínea; nada se re-parsea). stdin_b64 se pipea al proceso (ideal para escribir archivos: argv ["tee","/data/x.py"] + stdin_b64 del contenido). Claves: solo $DATA_DIR sobrevive reinicios (/app se reconstruye del bundle en cada boot); tu app escucha en 127.0.0.1:8081; el guard en 8080 exige el header x-alora-proxy-auth con $ALORA_PROXY_SECRET (está en el env de la VM) — para pegarle a un endpoint propio: curl -H "x-alora-proxy-auth: $ALORA_PROXY_SECRET" http://127.0.0.1:8080/ruta.',
+  inputSchema: {
+    project: z.string(),
+    command: z.string().optional().describe('Comando via sh (modo simple)'),
+    argv: z.array(z.string()).optional().describe('Comando como array literal, sin shell (modo seguro para quoting)'),
+    stdin_b64: z.string().optional().describe('Contenido en base64 para pipear al stdin del proceso'),
+  },
+}, wrap(({ project, command, argv, stdin_b64 }) => client().exec(project, { command, argv, stdin_b64 })));
 
 server.registerTool('restart', {
   description: 'Reinicia la app sin redesplegar (útil para aplicar un cambio de estado o salir de un cuelgue).',
@@ -182,8 +187,12 @@ server.registerTool('egress_ip_release', {
 
 server.registerTool('token_create', {
   description: 'Crea un token de acceso por proyecto que BYPASSEA el login: un script/webhook/backup externo puede pegarle a la URL de la app con Authorization: Bearer <token> sin SSO. Scoped a este proyecto y revocable. La app lo ve con x-alora-user-role: service. El token se muestra una sola vez.',
-  inputSchema: { project: z.string(), name: z.string().optional() },
-}, wrap(({ project, name }) => client().tokenCreate(project, name)));
+  inputSchema: {
+    project: z.string(),
+    name: z.string().optional(),
+    paths: z.array(z.string()).optional().describe('Scoping: prefijos de ruta que el token puede tocar, ej ["/export","/api/hook"]. Sin paths vale para toda la app.'),
+  },
+}, wrap(({ project, name, paths }) => client().tokenCreate(project, name, paths)));
 
 server.registerTool('list_versions', {
   description: 'Historial de versiones del proyecto, con autor y mensaje.',