brewpage-mcp 1.19.1 → 1.20.0

package/README.md

@@ -8,7 +8,7 @@ MCP server for [BrewPage](https://brewpage.app) -- publish and manage HTML, KV,
 
 ## What is BrewPage
 
-[BrewPage](https://brewpage.app) is a free instant hosting platform designed for AI agents and developers. One `POST` request publishes HTML, Markdown, a multi-file site, a JSON document, or a binary file and returns its primary HTTPS link -- no account needed, no API keys, no infrastructure setup. Every resource carries an **owner token** returned at creation time: use it to update content in place, delete the resource, or authenticate list operations across sessions. `brewpage-mcp` exposes this API as thirty typed MCP tools so any compatible agent -- Claude, Codex, Gemini, Cursor, Cline -- can publish, update, fetch, and manage BrewPage HTML, JSON, KV, and file content without leaving the conversation.
+[BrewPage](https://brewpage.app) is a free instant hosting platform designed for AI agents and developers. One `POST` request publishes HTML, Markdown, a multi-file site, a JSON document, or a binary file and returns its primary HTTPS link -- no account needed, no API keys, no infrastructure setup. Every resource carries an **owner token** returned at creation time: use it to update content in place, delete the resource, or authenticate list operations across sessions. `brewpage-mcp` exposes this API as thirty-two typed MCP tools so any compatible agent -- Claude, Codex, Gemini, Cursor, Cline -- can publish, update, fetch, and manage BrewPage HTML, JSON, KV, and file content without leaving the conversation.
 
 Optional: sign in free (Google or any email) at https://account.brewpage.app to never lose your pages or tokens and to mint tokens that never expire. Not needed to publish.
 
@@ -18,7 +18,7 @@ Choosing a host? See how BrewPage compares with GitHub Pages, Netlify Drop, Tiin
 
 ### Remote (no install)
 
-One remote MCP server for every client: `https://brewpage.app/mcp` (Streamable HTTP, no authentication, same 30 tools). Add it by URL in Claude (a custom connector), ChatGPT (a custom MCP server) or any Streamable HTTP client.
+One remote MCP server for every client: `https://brewpage.app/mcp` (Streamable HTTP, no authentication, same 32 tools). Add it by URL in Claude (a custom connector), ChatGPT (a custom MCP server) or any Streamable HTTP client.
 
 Claude Code: `claude mcp add --transport http brewpage --scope user https://brewpage.app/mcp` (leave out `--scope user` to add it to the current project only), or in `.mcp.json`:
 
@@ -38,7 +38,7 @@ Claude Code: `claude mcp add --transport http brewpage --scope user https://brew
 For clients that only start local servers; the same tools as the server URL.
 
 ```bash
-npx -y brewpage-mcp@1.19.1
+npx -y brewpage-mcp@1.20.0
 ```
 
 Requires Node.js 20 or newer. This starts the stdio server for an MCP client.
@@ -63,7 +63,7 @@ Local fallback (stdio, needs Node.js; the same tools): add to `~/Library/Applica
   "mcpServers": {
     "brewpage": {
       "command": "npx",
-      "args": ["-y", "brewpage-mcp@1.19.1"]
+      "args": ["-y", "brewpage-mcp@1.20.0"]
     }
   }
 }
@@ -86,7 +86,7 @@ Custom servers follow your ChatGPT plan and workspace settings.
 The remote command above is the default. Local fallback: register a project-scoped stdio server:
 
 ```bash
-claude mcp add --transport stdio --scope project brewpage -- npx -y brewpage-mcp@1.19.1
+claude mcp add --transport stdio --scope project brewpage -- npx -y brewpage-mcp@1.20.0
 ```
 
 This writes `.mcp.json` in the project root. Use `--scope user` for user-scoped registration. See the [official Claude Code MCP guide](https://code.claude.com/docs/en/mcp).
@@ -110,7 +110,7 @@ Local fallback (stdio, needs Node.js; the same tools): open **Settings > MCP** a
   "mcpServers": {
     "brewpage": {
       "command": "npx",
-      "args": ["-y", "brewpage-mcp@1.19.1"]
+      "args": ["-y", "brewpage-mcp@1.20.0"]
     }
   }
 }
@@ -124,14 +124,14 @@ Open the Cline MCP settings panel and add:
 {
   "brewpage": {
     "command": "npx",
-    "args": ["-y", "brewpage-mcp@1.19.1"]
+    "args": ["-y", "brewpage-mcp@1.20.0"]
   }
 }
 ```
 
 ## Tools
 
-Thirty tools are available. Creation returns an owner token; keep it to modify or delete the resource later. Owner tools take `ownerToken`, else `BREWPAGE_OWNER_TOKEN` (local server only). Supported password inputs use `X-Password`. Secrets allowed; likely ones are flagged in notices. For a secret: private namespace + password.
+Thirty-two tools are available. Creation returns an owner token; keep it to modify or delete the resource later. Owner tools take `ownerToken`, else `BREWPAGE_OWNER_TOKEN` (local server only). Supported password inputs use `X-Password`. Secrets allowed; likely ones are flagged in notices. For a secret: private namespace + password.
 
 | Tool | Purpose |
 |------|---------|
@@ -149,7 +149,9 @@ Thirty tools are available. Creation returns an owner token; keep it to modify o
 | `get_kv` | Read a KV value |
 | `update_hosting` | Change eligible delivery mode with owner token and hosting version |
 | `delete_resource` | Delete an HTML page, site, JSON document, KV store or file |
-| `set_visibility` | Hide or show a public publication in the gallery and sitemap; link unchanged |
+| `set_visibility` | List or unlist a public publication in the gallery and sitemap; link unchanged |
+| `make_private` | Make a public publication private: new private link, the public link stops working; one-way |
+| `set_badge` | Hide or show the BrewPage badge on a publication of your profile, up to 5 hidden |
 | `set_title` | Rename an HTML page or site; the title stays on republish; link unchanged |
 | `bind_token` | Add an owner token to your profile (admin token) |
 | `mint_token` | Mint a profile token, shown once (admin token) |
@@ -436,9 +438,9 @@ delete_resource(type="html", namespace="public", id="aBcDeFgHiJ", ownerToken="to
 
 ### `set_visibility`
 
-Hide or show a public publication in the gallery and sitemap; the link stays the same. Only public, password-free HTML, sites and files can be listed; others answer with a `visibility-not-listable` notice.
+List or unlist a public publication in the gallery and sitemap; the link stays the same. Only public, password-free HTML, sites and files can be listed; others answer with a `visibility-not-listable` notice.
 
-Parameters: `type` (`html` | `site` | `file` | `json` | `kv`), `namespace`, `id`, `listed` (boolean), `ownerToken` (optional).
+Parameters: `type` (`html` | `site` | `file` | `json` | `kv`), `namespace`, `id`, `listed` (boolean: `true` = listed, `false` = unlisted), `ownerToken` (optional).
 
 ```
 set_visibility(type="html", namespace="public", id="aBcDeFgHiJ", listed=false)
@@ -448,6 +450,34 @@ Output: `LISTED: false · link unchanged`.
 
 ---
 
+### `make_private`
+
+Make a public publication private (`POST /api/{type}/{ns}/{id}/private`): it gets a new private link in a private namespace under a new id, and the public link stops working. Views and stats stay; a custom domain on it is detached. One-way: to go public again, publish again. The owner token stays the same; later calls take the new namespace and id.
+
+Parameters: `type` (`html` | `site` | `file` | `json` | `kv`), `namespace` (`public`), `id`, `ownerToken` (optional).
+
+```
+make_private(type="html", namespace="public", id="aBcDeFgHiJ")
+```
+
+Output: `MADE PRIVATE · the public link no longer works`, then the new link, namespace and id, and the new management link when the publication had one. Give the user the new link and the management link. A publication outside `public` answers 409 `NOT_PUBLIC`.
+
+---
+
+### `set_badge`
+
+Hide or show the BrewPage badge on a publication (`POST /api/{type}/{ns}/{id}/badge`). HTML pages and sites show a small BrewPage badge; page code must not hide or alter it. Hiding works when the publication's owner token is in a BrewPage profile: sign in free at https://account.brewpage.app, then `bind_token`. A profile hides the badge on up to 5 publications; showing it again frees the slot.
+
+Parameters: `type` (`html` | `site` | `file` | `json` | `kv`), `namespace`, `id`, `hidden` (optional boolean: `true` = hide, `false` = show; omitted reports the current state), `ownerToken` (optional).
+
+```
+set_badge(type="html", namespace="public", id="aBcDeFgHiJ", hidden=true)
+```
+
+Output: `BADGE: hidden · 2 of 5 hidden in the profile · link unchanged`. Without a profile the badge stays shown and the result carries the `badge-hide-needs-profile` notice; a sixth hide answers 409 `BADGE_HIDDEN_LIMIT`.
+
+---
+
 ### `set_title`
 
 Rename an HTML page or site: the title shown in the gallery, profile, search and link cards (`POST /api/{html|sites}/{ns}/{id}/title`). The new title stays when you republish; the link stays the same. Works when the publication's owner token is in a BrewPage profile: sign in at https://account.brewpage.app, then `bind_token`; otherwise 403 with a hint.
@@ -725,6 +755,10 @@ Every publish response includes an **owner token** -- the only credential that a
 
 ## Changelog
 
+## 1.20.0 -- 2026-11-12
+
+- Two new tools. `make_private` turns a public publication into a private one: new private link, the public link stops working, views and stats stay; one-way. `set_badge` hides or shows the BrewPage badge on a publication of your profile, up to 5 hidden. `set_visibility` reads as list or unlist; inputs unchanged. The server instructions and the tools that send page code say that page code must not hide or alter the badge. Thirty-two tools. Contract 2.27.0. `User-Agent: brewpage-mcp/1.20.0`.
+
 ## 1.19.1 -- 2026-11-12
 
 - README only: the remote server `https://brewpage.app/mcp` comes first, with setup steps for Claude and ChatGPT; the local `npx` server is the fallback; the global install section is removed. No tool or input change. Contract 2.22.0. `User-Agent: brewpage-mcp/1.19.1`.

package/dist/tools.d.ts

@@ -1,6 +1,6 @@
 import { McpServer } from "@modelcontextprotocol/server";
 export declare const DEFAULT_BASE_URL = "https://brewpage.app";
-export declare const USER_AGENT = "brewpage-mcp/1.19.1";
+export declare const USER_AGENT = "brewpage-mcp/1.20.0";
 export declare const OWNER_TOKEN_ENV = "BREWPAGE_OWNER_TOKEN";
 /** Server instructions of the handshake: one paragraph per line; the first stands alone within 512 chars. */
 export declare const SERVER_INSTRUCTIONS: string;

package/dist/tools.js

@@ -2,13 +2,14 @@ import { McpServer } from "@modelcontextprotocol/server";
 import { z } from "zod";
 import { PAGE_DATA_CALLS, PAGE_DATA_GUIDE } from "./guides/page-data.js";
 export const DEFAULT_BASE_URL = "https://brewpage.app";
-export const USER_AGENT = "brewpage-mcp/1.19.1";
+export const USER_AGENT = "brewpage-mcp/1.20.0";
 export const OWNER_TOKEN_ENV = "BREWPAGE_OWNER_TOKEN";
 /** Server instructions of the handshake: one paragraph per line; the first stands alone within 512 chars. */
 export const SERVER_INSTRUCTIONS = [
     "BrewPage publishes HTML, Markdown, sites, files, JSON and KV and returns a share link plus an owner token. Keep the owner token private and send it as ownerToken on every later call for that publication; it cannot be recovered. A page that must save what its visitors enter (form answers, guestbook, votes, scores, game progress) needs Page data: read get_guide topic page-data BEFORE writing the page, then publish with the state argument.",
     "After publishing, give the user the page link and the management link from the result. Say that the management link is private: whoever has it can edit or delete the page, and its Data tab shows what visitors saved.",
     "KV and JSON tools hold your own data. Page data holds what a page's visitors save: get_page_data reads it, set_page_data writes author entries, configure_page_data changes who can read a list, delete_page_data moderates. In a later chat these four take the management link as manageUrl.",
+    "HTML pages and sites show a small BrewPage badge; page code must not hide or alter it. A profile can turn it off on up to 5 pages (set_badge).",
 ].join("\n");
 const READ_ONLY = { readOnlyHint: true };
 const DESTRUCTIVE = { readOnlyHint: false, destructiveHint: true };
@@ -27,6 +28,10 @@ const NO_PUBLIC_CREDENTIALS = "BrewPage tokens and manage links must never be in
 const SECRETS = "Secrets allowed; likely ones are flagged in notices. Private namespace + password suit secrets. " +
     NO_PUBLIC_CREDENTIALS;
 const MANAGE_URL_TEXT = "Returns manageUrl, a private management link (grants control; not for public sharing).";
+/** Badge sentence of the four tools that publish or replace page code. */
+const BADGE_TEXT = "Page code must not hide or alter the BrewPage badge; a profile can turn the badge off for a page.";
+const BADGE_NEEDS_PROFILE_CODE = "badge-hide-needs-profile";
+const BADGE_NEEDS_PROFILE_NEXT = "Next: sign in at https://account.brewpage.app, add this publication's owner token with bind_token, then retry.";
 const OLD_READ_ONLY_CODE = "OLD_PUBLICATION_READ_ONLY";
 const WRONG_TYPE_CODE = "WRONG_RESOURCE_TYPE";
 /** 403 message of a rename on a publication no profile owns. */
@@ -466,7 +471,7 @@ function ownerLinkLines(data) {
         lines.push(``, `MANAGE LINK (private): ${data.manageUrl}`, `Give it to the user with the link: anyone who has it can edit or delete this publication. Never post it publicly.`);
     }
     if (data.listed === true && !hasCredentialNotice(data))
-        lines.push(``, `VISIBILITY: public, listed. Hide: set_visibility listed=false`);
+        lines.push(``, `VISIBILITY: public, listed. Unlist: set_visibility listed=false`);
     return lines;
 }
 /** Optional delivery fields on HTML and hosting responses: why the mode was chosen, flagged or not applied. */
@@ -513,7 +518,7 @@ export function createServer(options = {}) {
     const apiFetch = options.fetch ?? fetch;
     const server = new McpServer({
         name: "brewpage-mcp",
-        version: "1.19.1",
+        version: "1.20.0",
     }, { instructions: SERVER_INSTRUCTIONS });
     /** Caller argument first, then the configured default; `fromEnv` marks the configured one. */
     function ownerTokenFor(argument) {
@@ -595,7 +600,7 @@ export function createServer(options = {}) {
             "A `public` page without deliveryMode may get its own subdomain if it needs browser features a BrewPage link lacks; " +
             "the result then has deliveryModeReason and a delivery notice. Markdown raw HTML is allowlisted: scripts, styles, event handlers, forms, embeds removed. " +
             "Optional `domain` connects a domain the user owns to an HTML-format page. " +
-            MANAGE_URL_TEXT + " " + SECRETS + " " + PUBLISH_STATE_TEXT,
+            MANAGE_URL_TEXT + " " + SECRETS + " " + BADGE_TEXT + " " + PUBLISH_STATE_TEXT,
         inputSchema: {
             content: z.string().describe("HTML, Markdown, code or JSON to publish"),
             deliveryMode: DELIVERY_MODE_SCHEMA,
@@ -858,7 +863,7 @@ export function createServer(options = {}) {
         ...toolMeta("Publish site", ADDITIVE),
         description: "Publish an HTML site to BrewPage. " + PUBLIC_HINT + "Single-page: `entryContent`. Multi-page: `files` (`{path, content}` array). Optional `entry` overrides `index.html`. Returns its primary share link and owner token. " +
             "Static only: HTML, CSS, JS (incl. built React/Vue bundles) run in the browser; server code (PHP etc.) never runs. " + SITE_LIMITS_TEXT +
-            " Optional `domain` connects a domain the user owns. " + MANAGE_URL_TEXT + " " + SECRETS + " " + PUBLISH_STATE_TEXT,
+            " Optional `domain` connects a domain the user owns. " + MANAGE_URL_TEXT + " " + SECRETS + " " + BADGE_TEXT + " " + PUBLISH_STATE_TEXT,
         inputSchema: {
             deliveryMode: DELIVERY_MODE_SCHEMA,
             entryContent: z
@@ -977,7 +982,7 @@ export function createServer(options = {}) {
     });
     server.registerTool("republish_site", {
         ...toolMeta("Republish site", DESTRUCTIVE),
-        description: "Republish (full-replace) an existing multi-file BrewPage site in place at the SAME URL/ID. Requires owner token. The uploaded bundle becomes the complete new file set — files absent from it are removed, new files added, matching files overwritten. Single-page: `entryContent`. Multi-page: `files` (array of `{path, content}`). Optional `entry` overrides the default `index.html`. Republishing preserves existing expiry." + OLD_READ_ONLY_TEXT + " " + SITE_LIMITS_TEXT + " " + NO_PUBLIC_CREDENTIALS,
+        description: "Republish (full-replace) an existing multi-file BrewPage site in place at the SAME URL/ID. Requires owner token. The uploaded bundle becomes the complete new file set — files absent from it are removed, new files added, matching files overwritten. Single-page: `entryContent`. Multi-page: `files` (array of `{path, content}`). Optional `entry` overrides the default `index.html`. Republishing preserves existing expiry." + OLD_READ_ONLY_TEXT + " " + SITE_LIMITS_TEXT + " " + NO_PUBLIC_CREDENTIALS + " " + BADGE_TEXT,
         inputSchema: {
             namespace: z.string().describe("Site namespace"),
             id: z.string().describe("Site ID"),
@@ -1076,7 +1081,7 @@ export function createServer(options = {}) {
         ...toolMeta("Update page", DESTRUCTIVE),
         description: "Update an existing BrewPage HTML, Markdown, code or JSON page. Requires owner token. Returns the updated page metadata. " +
             "Format omitted keeps the stored format, except a whole HTML document makes a Markdown page an HTML page. " +
-            "The link and delivery mode never change on update; an advisory deliveryModeReason and delivery notice are included when the new content uses browser features that may not work fully on a BrewPage link." + OLD_READ_ONLY_TEXT + " " + NO_PUBLIC_CREDENTIALS,
+            "The link and delivery mode never change on update; an advisory deliveryModeReason and delivery notice are included when the new content uses browser features that may not work fully on a BrewPage link." + OLD_READ_ONLY_TEXT + " " + NO_PUBLIC_CREDENTIALS + " " + BADGE_TEXT,
         inputSchema: {
             namespace: z.string().describe("Page namespace"),
             id: z.string().describe("Page ID"),
@@ -1475,12 +1480,12 @@ export function createServer(options = {}) {
     });
     server.registerTool("set_visibility", {
         ...toolMeta("Set gallery visibility", ADDITIVE),
-        description: "Hide or show a public publication in the gallery and sitemap. Link unchanged.",
+        description: "List or unlist a public publication in the gallery and sitemap. Link unchanged.",
         inputSchema: {
             type: z.enum(["html", "site", "file", "json", "kv"]).describe("Publication type; only public html, site and file can be listed"),
             namespace: z.string().describe("Publication namespace"),
             id: z.string().describe("Publication ID"),
-            listed: z.boolean().describe("false = hide, true = show"),
+            listed: z.boolean().describe("true = listed, false = unlisted"),
             ownerToken: z.string().optional().describe(OWNER_TOKEN_DESCRIPTION),
         },
     }, async ({ type, namespace, id, listed, ownerToken }) => {
@@ -1494,6 +1499,64 @@ export function createServer(options = {}) {
         const result = data;
         return textResult([...credentialAlertLines(result), `LISTED: ${result.listed} · link unchanged`, ...noticeLines(result)].join("\n"));
     });
+    server.registerTool("make_private", {
+        ...toolMeta("Make private", DESTRUCTIVE),
+        description: "Make a public publication private: it gets a new private link and the public link stops working; a custom domain on it is detached. One-way. " +
+            "Returns the new link, namespace and id, plus a new management link when the publication had one; the owner token stays the same.",
+        inputSchema: {
+            type: z.enum(["html", "site", "file", "json", "kv"]).describe("Publication type"),
+            namespace: z.string().describe("Publication namespace; only `public` publications can be made private"),
+            id: z.string().describe("Publication ID"),
+            ownerToken: z.string().optional().describe(OWNER_TOKEN_DESCRIPTION),
+        },
+    }, async ({ type, namespace, id, ownerToken }) => {
+        const auth = ownerTokenFor(ownerToken);
+        if (!auth.token)
+            return textResult(NO_OWNER_TOKEN, true);
+        const path = apiPath(TYPE_SEGMENTS[type], namespace, id, "private");
+        const { ok, status, data, headers: answerHeaders } = await apiRequest("POST", path, undefined, { "X-Owner-Token": auth.token });
+        if (!ok)
+            return ownerFailure("make private", status, data, auth.fromEnv, answerHeaders);
+        const result = data;
+        return textResult([
+            ...credentialAlertLines(result),
+            `MADE PRIVATE · the public link no longer works`,
+            ``,
+            `New link: ${result.link || "N/A"}`,
+            `Namespace: ${result.namespace || "N/A"}`,
+            `ID: ${result.id || "N/A"}`,
+            `Give the user the new link. Later calls take this namespace and ID with the same owner token.`,
+            ...noticeLines(result),
+            ...ownerLinkLines(result),
+        ].join("\n"));
+    });
+    server.registerTool("set_badge", {
+        ...toolMeta("Hide or show badge", ADDITIVE),
+        description: "Hide or show the BrewPage badge on a publication. Needs an owner token that is in a BrewPage profile (free sign-in at https://account.brewpage.app); up to 5 hidden per profile.",
+        inputSchema: {
+            type: z.enum(["html", "site", "file", "json", "kv"]).describe("Publication type"),
+            namespace: z.string().describe("Publication namespace"),
+            id: z.string().describe("Publication ID"),
+            hidden: z.boolean().optional().describe("true = hide the badge, false = show it. Omit: report the current state."),
+            ownerToken: z.string().optional().describe(OWNER_TOKEN_DESCRIPTION),
+        },
+    }, async ({ type, namespace, id, hidden, ownerToken }) => {
+        const auth = ownerTokenFor(ownerToken);
+        if (!auth.token)
+            return textResult(NO_OWNER_TOKEN, true);
+        const path = apiPath(TYPE_SEGMENTS[type], namespace, id, "badge");
+        const { ok, status, data, headers: answerHeaders } = await apiRequest("POST", path, hidden === undefined ? {} : { hidden }, { "X-Owner-Token": auth.token });
+        if (!ok)
+            return ownerFailure("set badge", status, data, auth.fromEnv, answerHeaders);
+        const result = data;
+        const used = typeof result.used === "number" && result.used > 0 ? ` · ${result.used} of ${result.limit} hidden in the profile` : "";
+        return textResult([
+            ...credentialAlertLines(result),
+            `BADGE: ${result.hidden === true ? "hidden" : "shown"}${used} · link unchanged`,
+            ...noticeLines(result),
+            ...(notices(result).some((n) => n.code === BADGE_NEEDS_PROFILE_CODE) ? [BADGE_NEEDS_PROFILE_NEXT] : []),
+        ].join("\n"));
+    });
     server.registerTool("set_title", {
         ...toolMeta("Rename page or site", ADDITIVE),
         description: "Rename an HTML page or site: the title shown in the gallery, profile, search and link cards. " +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brewpage-mcp",
-  "version": "1.19.1",
+  "version": "1.20.0",
   "mcpName": "io.github.kochetkov-ma/brewpage-mcp",
   "description": "MCP server for BrewPage — publish and manage HTML, sites, KV, JSON and files from AI assistants",
   "type": "module",