brewpage-mcp 1.13.0 → 1.13.2

package/README.md

@@ -17,7 +17,7 @@ Choosing a host? See how BrewPage compares with GitHub Pages, Netlify Drop, Tiin
 ## Quick Start
 
 ```bash
-npx -y brewpage-mcp@1.13.0
+npx -y brewpage-mcp@1.13.2
 ```
 
 Requires Node.js 20 or newer. This starts the stdio server for an MCP client.
@@ -33,7 +33,7 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
   "mcpServers": {
     "brewpage": {
       "command": "npx",
-      "args": ["-y", "brewpage-mcp@1.13.0"]
+      "args": ["-y", "brewpage-mcp@1.13.2"]
     }
   }
 }
@@ -44,7 +44,7 @@ Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
 Register a project-scoped stdio server:
 
 ```bash
-claude mcp add --transport stdio --scope project brewpage -- npx -y brewpage-mcp@1.13.0
+claude mcp add --transport stdio --scope project brewpage -- npx -y brewpage-mcp@1.13.2
 ```
 
 This writes `.mcp.json` in the project root. Use `--scope user` for user-scoped registration. See the [official Claude Code MCP guide](https://code.claude.com/docs/en/mcp).
@@ -58,7 +58,7 @@ Open **Settings > MCP** and add:
   "mcpServers": {
     "brewpage": {
       "command": "npx",
-      "args": ["-y", "brewpage-mcp@1.13.0"]
+      "args": ["-y", "brewpage-mcp@1.13.2"]
     }
   }
 }
@@ -72,7 +72,7 @@ Open the Cline MCP settings panel and add:
 {
   "brewpage": {
     "command": "npx",
-    "args": ["-y", "brewpage-mcp@1.13.0"]
+    "args": ["-y", "brewpage-mcp@1.13.2"]
   }
 }
 ```
@@ -80,7 +80,7 @@ Open the Cline MCP settings panel and add:
 ### Global Install
 
 ```bash
-npm install -g brewpage-mcp@1.13.0
+npm install -g brewpage-mcp@1.13.2
 brewpage-mcp
 ```
 
@@ -104,14 +104,14 @@ Twenty tools are available. Creation returns an owner token; keep it to modify o
 | `get_kv` | Read a KV value |
 | `update_hosting` | Change eligible delivery mode with owner token and hosting version |
 | `delete_resource` | Delete an HTML page, site, JSON document, KV store or file |
-| `set_visibility` | Hide or show a public publication in gallery & search; link unchanged |
+| `set_visibility` | Hide or show a public publication in the gallery and sitemap; link unchanged |
 | `bind_token` | Add an owner token to your profile (admin token) |
 | `mint_token` | Mint a profile token, shown once (admin token) |
 | `search_gallery` | Browse public content or list owned resources |
 | `get_stats` | Read platform-wide statistics |
 | `get_limits` | Read the current upload limits (`GET /api/limits`) |
 
-All five publish tools accept optional `deliveryMode: "path" | "subdomain"`, sent only as `X-Delivery-Mode`; authored JSON and multipart bodies keep their existing format. Visibility and password protection are separate choices. Omitted namespace still generates an unlisted `priv-<random>` namespace; anyone with an unpassworded unlisted link can read it. `public` grants gallery/search eligibility only; password-protected content remains excluded and unlisted, protected or otherwise ineligible native responses carry `noindex`; eligible public HTML, sites and files may permit indexing.
+All five publish tools accept optional `deliveryMode: "path" | "subdomain"`, sent only as `X-Delivery-Mode`; authored JSON and multipart bodies keep their existing format. Visibility and password protection are separate choices. Omitted namespace is private (a generated `priv-<random>` namespace): unlisted and not indexed; anyone with the link can still open it. `public` lists HTML, sites and files in the gallery and sitemap, so Google, Bing and AI search can find and index them; public pages are served on the brewpage.app domain for the strongest reach (a site always gets its own subdomain). Never put secrets in a public publication. Password-protected publications, JSON and KV are never listed.
 
 The MCP server wraps a subset of the backend-generated public [REST contract](../openapi/openapi.json). TTL inputs take days or a string such as `2w`/`36h` (default 15); the server rounds to whole days and clamps to 1–30 (owner-specific caps and eligible automatic extensions can differ). Use returned `expiresAt`. Every tolerated-input adjustment (TTL clamp, format alias, skipped site member, normalised namespace) comes back in the response `notices` array and is printed as `Notice (code): message`; `secret-detected` and `manage-link-disabled` print as `WARNING (code): message`: relay them to the user. A minted `manageUrl` prints as `MANAGE LINK (private): …`: give it to the user privately, never publish it. A listed public result prints `VISIBILITY: public, listed. Hide: set_visibility listed=false`. `get_page` reads stored rendered HTML or format-specific code/text from the API; it does not call the owner-only original-source endpoint or a browser viewer. `publish_file` uploads from a source URL and does not expose password or TTL inputs.
 
@@ -141,7 +141,7 @@ update_hosting(type="html", namespace="public", id="aBcDeFgHiJ", ownerToken="tok
 
 Publish HTML or Markdown content to BrewPage. Returns a public URL and owner token. Markdown raw HTML is rendered through an allowlist: scripts, styles, event handlers, forms, frames/embeds and `meta`/`base`/`link` are removed; links allow `http`, `https`, `mailto`, `tel` and relative URLs, images also `data:`; a lone unknown tag such as `<author>` shows as text.
 
-Parameters: `content` (string), `format` (default `HTML`; `HTML`, `MARKDOWN` or an alias the server maps, e.g. `md`), `namespace` (optional -- **omit for unlisted content**; pass `public` only for gallery/search eligibility, except when password-protected), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `filename` (optional, used as title fallback), `showTopBar` (optional boolean -- adds a toolbar with filename, Download button, and theme toggle), `deliveryMode` (optional).
+Parameters: `content` (string), `format` (default `HTML`; `HTML`, `MARKDOWN` or an alias the server maps, e.g. `md`), `namespace` (optional -- **omit for private, unlisted content**; `public` lists the page in the gallery and sitemap for Google, Bing and AI search, served on the brewpage.app domain; never put secrets there), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `filename` (optional, used as title fallback), `showTopBar` (optional boolean -- adds a toolbar with filename, Download button, and theme toggle), `deliveryMode` (optional).
 
 The result includes `deliveryModeReason` and a `Delivery notice:` line when the server returns them (see above).
 
@@ -197,7 +197,7 @@ get_page(namespace="public", id="aBcDeFgHiJ")
 
 Upload a file to BrewPage by fetching it from a URL. Returns a public URL and owner token. Supports images, PDFs, video, audio, code files, and archives.
 
-Parameters: `url` (string, the source URL to fetch), `namespace` (optional -- omit to keep the file private/unlisted: reachable only by its link, not in the gallery, not search-indexed; pass `public` only for gallery/search eligibility), `filename` (optional custom filename), `deliveryMode` (optional). This tool does not expose base64, password, or TTL inputs.
+Parameters: `url` (string, the source URL to fetch), `namespace` (optional -- omit to keep the file private: unlisted and not indexed, anyone with the link can open it; `public` lists the file in the gallery and sitemap for Google, Bing and AI search), `filename` (optional custom filename), `deliveryMode` (optional). This tool does not expose base64, password, or TTL inputs.
 
 Example prompt:
 
@@ -217,7 +217,7 @@ Publish a single-page or multi-file HTML site. Pass `entryContent` for a single
 
 Limits (current values from `get_limits`): a request is at most 25 MB; a site at most 200 files, 5 MB per file and 20 MB in total; each path at most 380 characters. System files such as `.DS_Store` and `__MACOSX/` are skipped and never count; files with an unsupported extension or a too-long path are skipped and reported in notices. Entry: `entry`, else root `index.html`, else the shallowest HTML file. A site limit hit answers 400 with a message naming the limit; 413 means the request is over 25 MB, has too many files and form fields, or a file name/path is too long; 422 means no servable file is left.
 
-Parameters: exactly one of `entryContent` (string) or non-empty `files` (array of `{path, content}`), `entry` (optional entry file path, default `index.html`), `namespace` (optional -- omit for unlisted content; `public` grants gallery eligibility except when password-protected), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `ownerToken` (optional, groups site under an existing owner), `deliveryMode` (optional; fresh sites require `subdomain`).
+Parameters: exactly one of `entryContent` (string) or non-empty `files` (array of `{path, content}`), `entry` (optional entry file path, default `index.html`), `namespace` (optional -- omit for private, unlisted content; `public` lists the site in the gallery and sitemap for Google, Bing and AI search; a site always gets its own subdomain), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `ownerToken` (optional, groups site under an existing owner), `deliveryMode` (optional; fresh sites require `subdomain`).
 
 Example prompt:
 
@@ -247,7 +247,7 @@ republish_site(namespace="public", id="aBcDeFgHiJ", ownerToken="tok_...", files=
 
 Publish a JSON document to BrewPage. Returns a public URL and owner token. The body may be passed as a JSON string or as a structured object.
 
-Parameters: `json` (string, object, or array), `namespace` (optional -- omit for unlisted content; `public` grants gallery/search eligibility, except when password-protected), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `tags` (optional `string[]`), `ownerToken` (optional existing owner), `deliveryMode` (optional).
+Parameters: `json` (string, object, or array), `namespace` (optional -- omit for private content; `public` is the shared public namespace; JSON is never listed or indexed, anyone with the link can open it), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `tags` (optional `string[]`), `ownerToken` (optional existing owner), `deliveryMode` (optional).
 
 Example prompt:
 
@@ -297,7 +297,7 @@ update_json(namespace="public", id="aBcDeFgHiJ", json={"mode": "dark", "version"
 
 Create a new KV (key/value) entry. Returns a public URL and owner token. The KV entry is addressed by `(namespace, id, key)`; this tool creates the entry and emits the generated `id` along with the owner token.
 
-Parameters: `key` (string), `value` (string), `namespace` (optional -- omit for unlisted content; `public` grants gallery/search eligibility, except when password-protected), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `tags` (optional `string[]`), `ownerToken` (optional existing owner), `deliveryMode` (optional).
+Parameters: `key` (string), `value` (string), `namespace` (optional -- omit for private content; `public` is the shared public namespace; KV is never listed or indexed, anyone with the link can open it), `password` (optional), `ttlDays` (days or a string such as `2w`; default 15; the server clamps to 1--30), `tags` (optional `string[]`), `ownerToken` (optional existing owner), `deliveryMode` (optional).
 
 Example prompt:
 
@@ -379,7 +379,7 @@ delete_resource(type="html", namespace="public", id="aBcDeFgHiJ", ownerToken="to
 
 ### `set_visibility`
 
-Hide or show a public publication in gallery & search; the link stays the same. Only public, password-free HTML, sites and files can be listed; others answer with a `visibility-not-listable` notice.
+Hide or show a public publication in the gallery and sitemap; the link stays the same. Only public, password-free HTML, sites and files can be listed; others answer with a `visibility-not-listable` notice.
 
 Parameters: `type` (`html` | `site` | `file` | `json` | `kv`), `namespace`, `id`, `listed` (boolean), `ownerToken` (optional).
 
@@ -443,7 +443,7 @@ get_limits()
 |--------------------|------|-------|
 | "Publish this HTML so I can share it" | `publish_html` | `format=HTML`; save `ownerToken` |
 | "Share these meeting notes as a link" | `publish_html` | `format=MARKDOWN`; readable rendered output |
-| "Host this AI-generated artifact" | `publish_html` | `namespace` optional; **private/unlisted by default**; `public` grants gallery/search eligibility except when protected |
+| "Host this AI-generated artifact" | `publish_html` | `namespace` optional; **private/unlisted by default**; `public` lists it in the gallery and sitemap |
 | "Upload this image / PDF / video" | `publish_file` | Fetches from URL; inline preview on short URL |
 | "Deploy this static site" | `publish_site` | Pass `files` array or `entryContent` |
 | "Replace the site I published" | `republish_site` | Owner token; complete bundle replaces all existing files |
@@ -491,6 +491,15 @@ Every publish response includes an **owner token** -- the only credential that a
 
 ## Changelog
 
+## 1.13.2 -- 2026-10-25
+
+- `namespace` guidance matches BrewPage 2.1.5: `public` lists HTML, sites and files in the gallery and sitemap for Google, Bing and AI search (pages on the brewpage.app domain, a site on its own subdomain); omitted stays private; JSON and KV are never listed. Private `publish_json`/`publish_kv` results no longer suggest `public` for listing.
+- Old publications (made before 5 October 2026): the 409 hint mentions `republishUrl` only when the server sends it (HTML pages).
+
+## 1.13.1 -- 2026-10-25
+
+- Old publications (made before 5 October 2026): update tools say they answer `409 OLD_PUBLICATION_READ_ONLY`; that failure adds a hint to publish the content anew and give the user the new URL and owner token.
+
 ## 1.13.0 -- 2026-10-25
 
 - Identifying `User-Agent: brewpage-mcp/1.13.0` on every BrewPage call.

package/dist/index.js

@@ -3,10 +3,10 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 const BASE_URL = process.env.BREWPAGE_URL || "https://brewpage.app";
-const USER_AGENT = "brewpage-mcp/1.13.0";
+const USER_AGENT = "brewpage-mcp/1.13.2";
 const server = new McpServer({
     name: "brewpage-mcp",
-    version: "1.13.0",
+    version: "1.13.2",
 });
 const OWNER_TOKEN_SHAPE = /^[A-Za-z0-9]{32}$/;
 const OWNER_TOKEN_ENV = "BREWPAGE_OWNER_TOKEN";
@@ -25,6 +25,8 @@ const CREATE_OWNER_TOKEN_DESCRIPTION = `Optional. Default: ${OWNER_TOKEN_ENV}, e
 const OWNER_TOKEN_DESCRIPTION = `Owner token from create. Default: ${OWNER_TOKEN_ENV}.`;
 const SECRETS = "Secrets allowed; likely ones are flagged in notices. For a secret: private namespace + password.";
 const MANAGE_URL_TEXT = "Returns manageUrl (private): give it to the user privately; never publish it.";
+const OLD_READ_ONLY_CODE = "OLD_PUBLICATION_READ_ONLY";
+const OLD_READ_ONLY_TEXT = ` Old publications (made before 5 October 2026) are read-only: 409 ${OLD_READ_ONLY_CODE}.`;
 /** Notice codes the agent must relay to the user. */
 const WARNING_CODES = new Set(["secret-detected", "manage-link-disabled"]);
 /** MCP type name -> REST path segment. */
@@ -42,13 +44,20 @@ function maskToken(token) {
 function textResult(text, isError = false) {
     return isError ? { content: [{ type: "text", text }], isError: true } : { content: [{ type: "text", text }] };
 }
-/** Owner-tool failure: the server answer verbatim plus a hint for a plain wrong-token 403. */
+/** Owner-tool failure: the server answer verbatim plus a hint for a plain wrong-token 403 or a frozen old publication. */
 function ownerFailure(operation, status, data, fromEnv) {
     const lines = [`Failed to ${operation} (${status}): ${JSON.stringify(data)}`];
     const code = data?.code;
     if (status === 403 && (code === undefined || code === "OWNER_AUTHORIZATION_FAILED")) {
         lines.push(`Wrong owner token for this publication. Use ownerToken from create.${fromEnv ? ` Sent: ${OWNER_TOKEN_ENV}.` : ""}`);
     }
+    if (status === 409 && code === OLD_READ_ONLY_CODE) {
+        const republishUrl = data.republishUrl;
+        lines.push("Read-only old publication: cannot be updated. Publish the content anew with the matching " +
+            "publish tool in the same namespace; give the user the NEW URL and owner token. The old URL keeps its old content " +
+            "until it expires." + (typeof republishUrl === "string" ? " Ignore republishUrl (browser-only)." : "") +
+            (operation === "set KV" ? " For KV, read all keys with get_kv and publish them together with publish_kv." : ""));
+    }
     return textResult(lines.join("\n"), true);
 }
 /** Every BrewPage call identifies the client; source-file downloads use plain fetch. */
@@ -58,12 +67,7 @@ function bpFetch(url, init = {}) {
     return fetch(url, { ...init, headers });
 }
 const PUBLIC_NAMESPACE = "public";
-/**
- * Generate a short, unlisted private namespace slug used when the caller omits
- * `namespace`. Sending an explicit non-public ns prevents the backend from
- * applying its `public` default and making the content discovery-eligible.
- * Format: `priv-<6 lowercase-alphanumeric chars>`.
- */
+/** Private namespace slug `priv-<6 lowercase-alphanumeric chars>` sent when the caller omits `namespace`. */
 function defaultPrivateNamespace() {
     const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
     let slug = "";
@@ -72,20 +76,28 @@ function defaultPrivateNamespace() {
     }
     return `priv-${slug}`;
 }
-/**
- * Resolve the effective namespace actually sent to the API: the caller's value
- * verbatim when provided (including `public`), otherwise a generated private slug.
- */
+/** Namespace sent to the API: the caller's value verbatim (including `public`), else a generated private slug. */
 function resolveNamespace(namespace) {
     return namespace && namespace.length > 0 ? namespace : defaultPrivateNamespace();
 }
-const UNLISTED_NOTICE = "Private: not listed. Anyone with the link can open it. Use namespace public for gallery & search.";
+const UNLISTED_NOTICE = "Private: not listed. Anyone with the link can open it.";
+const LISTABLE_HINT = " Use namespace public to list it in the gallery and sitemap.";
 const PROTECTED_UNLISTED_NOTICE = "Password: link + password. Not listed.";
-const NAMESPACE_DESCRIPTION = "Optional. Omit to generate an unlisted namespace: anyone with its unpassworded link can read it, " +
-    "but it is excluded from gallery/search. Pass a custom namespace to group unlisted content, " +
-    "or pass `public` ONLY when the user explicitly wants gallery/search eligibility. " +
-    "Password-protected content stays excluded; unlisted, protected or otherwise ineligible native responses carry noindex; eligible public HTML, sites and files may permit indexing. " +
-    "Lowercase only: 1-32 of a-z, 0-9, hyphen.";
+const PUBLIC_NAMESPACE_LEAD = "namespace=public: listed in the public gallery and the sitemap, so Google, Bing and AI search can find and index it " +
+    "and people can discover it. Use it for anything meant to be found or shared: docs, guides, demos, portfolios, reports, landing pages. ";
+const PUBLIC_NAMESPACE_TAIL = " Anyone can find and read a public page: never put secrets, tokens or personal data there. " +
+    "Omit (default): private. Unlisted and not indexed; anyone who has the link can still open it. ";
+const NAMESPACE_FORMAT = "Lowercase only: 1-32 of a-z, 0-9, hyphen.";
+/** `namespace` for publish_html and publish_file. */
+const NAMESPACE_DESCRIPTION = PUBLIC_NAMESPACE_LEAD +
+    "Public pages are served right on the brewpage.app domain, which gives them the strongest reach in search; " +
+    "a page whose code needs its own origin (cookies, storage) gets its own subdomain automatically." +
+    PUBLIC_NAMESPACE_TAIL + NAMESPACE_FORMAT;
+const SITE_NAMESPACE_DESCRIPTION = PUBLIC_NAMESPACE_LEAD + "A site always gets its own subdomain." +
+    PUBLIC_NAMESPACE_TAIL + NAMESPACE_FORMAT;
+/** `namespace` for publish_json and publish_kv: data is never listed. */
+const DATA_NAMESPACE_DESCRIPTION = "Omit (default): private. namespace=public: the shared public namespace. JSON and KV are never listed in the gallery " +
+    "or indexed, in any namespace; anyone who has the link can open it. " + NAMESPACE_FORMAT;
 const TTL_SCHEMA = z.union([z.number().positive(), z.string().min(1).max(32)]).optional().describe("Requested TTL: days as a number, or a string such as '2w', '36h' or '1 month' (default 15 days). " +
     "The server rounds to whole days and clamps to the allowed range (1-30 by default; owner caps differ), reporting each adjustment in notices; use returned expiresAt.");
 const DELIVERY_MODE_SCHEMA = z.enum(["path", "subdomain"]).optional().describe("Optional delivery choice for a fresh publication, independent of password/namespace. " +
@@ -172,7 +184,7 @@ async function apiRequest(method, path, body, headers, responseType = "json") {
     const data = responseType === "text" ? await res.text() : await res.json().catch(() => null);
     return { ok: res.ok, status: res.status, data, headers: res.headers };
 }
-function formatPublishResponse(data, effectiveNamespace, sentOwnerToken) {
+function formatPublishResponse(data, effectiveNamespace, sentOwnerToken, listable = true) {
     const lines = [
         `Published successfully!`,
         ``,
@@ -188,7 +200,7 @@ function formatPublishResponse(data, effectiveNamespace, sentOwnerToken) {
     lines.push(...ownerLinkLines(data));
     const ns = (data.namespace ?? effectiveNamespace) || "";
     if (ns !== PUBLIC_NAMESPACE) {
-        lines.push(``, data.access === "protected" ? PROTECTED_UNLISTED_NOTICE : UNLISTED_NOTICE);
+        lines.push(``, data.access === "protected" ? PROTECTED_UNLISTED_NOTICE : UNLISTED_NOTICE + (listable ? LISTABLE_HINT : ""));
     }
     return lines.join("\n");
 }
@@ -470,7 +482,7 @@ server.tool("publish_site", "Publish an HTML site to BrewPage. Single-page: pass
     namespace: z
         .string()
         .optional()
-        .describe(NAMESPACE_DESCRIPTION),
+        .describe(SITE_NAMESPACE_DESCRIPTION),
     password: z
         .string()
         .optional()
@@ -557,13 +569,13 @@ server.tool("publish_site", "Publish an HTML site to BrewPage. Single-page: pass
     lines.push(...ownerLinkLines(site));
     const ns = (site.namespace || effectiveNamespace) || "";
     if (ns !== PUBLIC_NAMESPACE) {
-        lines.push(``, site.access === "protected" ? PROTECTED_UNLISTED_NOTICE : UNLISTED_NOTICE);
+        lines.push(``, site.access === "protected" ? PROTECTED_UNLISTED_NOTICE : UNLISTED_NOTICE + LISTABLE_HINT);
     }
     return {
         content: [{ type: "text", text: lines.join("\n") }],
     };
 });
-server.tool("republish_site", "Republish (full-replace) an existing multi-file BrewPage site in place at the SAME URL/ID. Requires owner token. The uploaded bundle becomes the complete new file set — files absent from it are removed, new files added, matching files overwritten. Single-page: pass `entryContent`. Multi-page: pass `files` (array of `{path, content}`). Optional `entry` overrides the default `index.html`. Republishing preserves existing expiry. " + SITE_LIMITS_TEXT, {
+server.tool("republish_site", "Republish (full-replace) an existing multi-file BrewPage site in place at the SAME URL/ID. Requires owner token. The uploaded bundle becomes the complete new file set — files absent from it are removed, new files added, matching files overwritten. Single-page: pass `entryContent`. Multi-page: pass `files` (array of `{path, content}`). Optional `entry` overrides the default `index.html`. Republishing preserves existing expiry." + OLD_READ_ONLY_TEXT + " " + SITE_LIMITS_TEXT, {
     namespace: z.string().describe("Site namespace"),
     id: z.string().describe("Site ID"),
     ownerToken: z.string().optional().describe(OWNER_TOKEN_DESCRIPTION),
@@ -656,7 +668,7 @@ server.tool("republish_site", "Republish (full-replace) an existing multi-file B
     };
 });
 server.tool("update_html", "Update an existing BrewPage HTML/Markdown page. Requires owner token. Returns the updated page metadata. " +
-    "The link and delivery mode never change on update; an advisory deliveryModeReason and delivery notice are included when the new content uses browser features that may not work fully on a BrewPage link.", {
+    "The link and delivery mode never change on update; an advisory deliveryModeReason and delivery notice are included when the new content uses browser features that may not work fully on a BrewPage link." + OLD_READ_ONLY_TEXT, {
     namespace: z.string().describe("Page namespace"),
     id: z.string().describe("Page ID"),
     content: z.string().describe("New HTML or Markdown content"),
@@ -696,7 +708,7 @@ server.tool("publish_json", "Publish a JSON document to BrewPage (repository def
     namespace: z
         .string()
         .optional()
-        .describe(NAMESPACE_DESCRIPTION),
+        .describe(DATA_NAMESPACE_DESCRIPTION),
     password: z
         .string()
         .optional()
@@ -748,7 +760,7 @@ server.tool("publish_json", "Publish a JSON document to BrewPage (repository def
         content: [
             {
                 type: "text",
-                text: formatPublishResponse(data, effectiveNamespace, owner),
+                text: formatPublishResponse(data, effectiveNamespace, owner, false),
             },
         ],
     };
@@ -786,7 +798,7 @@ server.tool("get_json", "Fetch a published BrewPage JSON document by namespace a
         ],
     };
 });
-server.tool("update_json", "Update an existing BrewPage JSON document. Requires owner token. Accepts a JSON object, array, or a JSON-encoded string.", {
+server.tool("update_json", "Update an existing BrewPage JSON document. Requires owner token. Accepts a JSON object, array, or a JSON-encoded string." + OLD_READ_ONLY_TEXT, {
     namespace: z.string().describe("Document namespace"),
     id: z.string().describe("Document ID"),
     json: z
@@ -827,7 +839,7 @@ server.tool("publish_kv", "Publish a key/value entry to BrewPage. Creates a KV s
     namespace: z
         .string()
         .optional()
-        .describe(NAMESPACE_DESCRIPTION),
+        .describe(DATA_NAMESPACE_DESCRIPTION),
     password: z
         .string()
         .optional()
@@ -874,12 +886,12 @@ server.tool("publish_kv", "Publish a key/value entry to BrewPage. Creates a KV s
         content: [
             {
                 type: "text",
-                text: formatPublishResponse(data, effectiveNamespace, owner),
+                text: formatPublishResponse(data, effectiveNamespace, owner, false),
             },
         ],
     };
 });
-server.tool("set_kv", "Set or update a key in an existing BrewPage KV store. Requires owner token. The key name `hosting` is reserved.", {
+server.tool("set_kv", "Set or update a key in an existing BrewPage KV store. Requires owner token. The key name `hosting` is reserved." + OLD_READ_ONLY_TEXT, {
     namespace: z.string().describe("KV store namespace"),
     id: z.string().describe("KV store ID"),
     key: z.string().describe("Key to set"),
@@ -1031,7 +1043,7 @@ server.tool("search_gallery", "Search the BrewPage public gallery. Optional filt
         ],
     };
 });
-server.tool("set_visibility", "Hide or show a public publication in gallery & search. Link unchanged.", {
+server.tool("set_visibility", "Hide or show a public publication in the gallery and sitemap. Link unchanged.", {
     type: z.enum(["html", "site", "file", "json", "kv"]).describe("Publication type; only public html, site and file can be listed"),
     namespace: z.string().describe("Publication namespace"),
     id: z.string().describe("Publication ID"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brewpage-mcp",
-  "version": "1.13.0",
+  "version": "1.13.2",
   "mcpName": "io.github.kochetkov-ma/brewpage-mcp",
   "description": "MCP server for BrewPage — publish and manage HTML, sites, KV, JSON and files from AI assistants",
   "type": "module",