bsv-mcp 0.5.1 → 0.6.1

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # BSV MCP Server Changelog
 
+## [0.6.1] - 2026-09-09
+
+### Changed
+
+- Consume published `bitcoin-backup@0.2.0` and `@opl.dev/vault@0.0.2` instead of
+  `file:` checkouts. Unpin zod from `overrides` and take `zod@^4.6.1`.
+- Raise `@1sat/actions` to `^0.0.208` and `@modelcontextprotocol/ext-apps` to
+  `^2.0.0`. Refresh React 19.3 and related UI types.
+- Import leftover plaintext key sources into Vault, then optionally erase the
+  source files. Passphrase policy is enforced before Vault create or unlock.
+- Stop tracking generated `dist/` in git. Work from source (`bun index.ts`).
+  `package.json` `files` plus `prepack` (`build:all`) are the npm tarball.
+  Compile-time libraries live in `devDependencies`; the published bundle does
+  not reinstall them.
+
+### Fixed
+
+- Keep MNEE tools off in context-only external-wallet catalogs.
+- Accept a test Vault passphrase that meets the strength policy.
+
+## [0.6.0] - 2026-09-09
+
+### Changed
+
+- Consolidate social tools into `bsocial_read` and `bsocial_publish` in both tool
+  profiles. Replace `bsocial_readPosts`, `bsocial_createPost`, `bmap_readPosts`,
+  `bmap_readLikes`, `bmap_readFollows`, and `bap_friend`; clients must refresh tools.
+- Add canonical social actions, replies, reactions, relationships, messages,
+  media, tags, and unsigned previews with one shared schema and signing path.
+- Document action-specific inputs and BMAP backend configuration. Messages are
+  public records; publishing does not encrypt them.
+
+### Fixed
+
+- Use social API routes and retain structured indexer records without claiming
+  independent signature verification or derived relationship state.
+- Sign legacy social records with an explicit identity key, fund with the payment
+  key, estimate unsigned transaction fees, and report broadcast failures.
+
 ## [0.5.1] - 2026-09-08
 
 ### Changed

package/README.md

@@ -14,6 +14,9 @@ codex mcp add bsv-mcp -- npx -y bsv-mcp@latest --stdio
 
 # Claude Code
 claude mcp add --transport stdio bsv-mcp -- npx -y bsv-mcp@latest --stdio
+
+# Grok Build
+grok plugin install b-open-io/bsv-mcp --trust
 ```
 
 Choose one command. For Cursor or Claude Desktop, use this server configuration:
@@ -111,6 +114,21 @@ protocol support guide](docs/mcp-client-protocol-support.md) for the per-family
 operation bounds, endpoint contracts, MCP Apps compatibility, and validation
 status.
 
+## Social
+
+Two tools cover social operations in both full and compact catalogs:
+
+- `bsocial_read`: posts, replies, search, likes, friends, channels, messages, videos, and raw action history.
+- `bsocial_publish`: posts/replies, reposts, likes/unlikes, follows/unfollows, friend/unfriend records, messages, and video records. Tags and attachments use separate, independently signed outputs.
+
+```json
+{"action":{"type":"post","content":"Hello Bitcoin","tags":["bitcoin"]},"preview":true}
+```
+
+Preview returns unsigned outputs without using keys or spending. Remove `preview` to publish through the selected identity wallet's existing permissions. Messages are public unless their content was encrypted beforehand; a recipient context does not encrypt them. Friend records advertise a communication public key from an established key-agreement workflow.
+
+See the [social guide](https://bsvmcp.com/docs#social) for examples and migration from the old tool names. `PUBLIC_BMAP_URL` is the indexer server root (with `/social` and `/q` routes), not a wallet or identity API. Raw follow/unfollow records are event history, not a claim about current relationship state.
+
 ## Local wallet modes
 
 External mode connects to an existing BRC-100 signer. The signer keeps the
@@ -171,15 +189,13 @@ and the dashboard app resource remain available.
 
 ## Bring your wallet and infrastructure
 
-Connect a compatible existing wallet with `BRC100_WALLET_URL`, select a legacy
-encrypted account with `BSV_MCP_ACCOUNT` and unlock it with
-`BSV_MCP_PASSWORD`, or use the local Vault browser setup. If setup is needed,
-ask your agent to run `wallet_onboarding`; after a restart, run it again to
-unlock the saved Vault. Startup never creates keys. An existing wallet keeps
-its keys and controls permissions. `PRIVATE_KEY_WIF` and `IDENTITY_KEY_WIF` are
-legacy compatibility inputs; they trigger a persistent Vault migration warning
-and should be removed after importing the keys into Vault. See the wallet setup
-guide for the required wallet API and configuration.
+Connect a compatible existing wallet with `BRC100_WALLET_URL`, or use the local
+Vault browser setup (`wallet_onboarding`). `BSV_MCP_PASSWORD` is only for
+headless agents: set it in the process environment for that session, never in
+MCP client configuration. `PRIVATE_KEY_WIF` and `IDENTITY_KEY_WIF` are
+migration sources, not live signing keys; import them into Vault and remove the
+plaintext copies. Startup never creates keys. See the wallet setup guide for
+the required wallet API and configuration.
 
 The default 1Sat API backend is `https://api.1sat.app`. New mainnet embedded
 accounts use `https://wallet.1sat.app` for wallet storage by default; testnet
@@ -210,11 +226,6 @@ Experimental software; APIs may change. Keep a wallet backup. If a transaction r
 
 ## Preparing a release package
 
-Run `bun run pack:release /tmp` to build and create the release tarball. Install
-or publish that tarball, for example `bun publish /tmp/bsv-mcp-0.5.1.tgz`,
-after completing the release checks and selecting the release version.
-Do not publish directly from the checkout: its manifest contains Bun patches
-needed to build the wallet fixes, which fail to resolve in consumer projects.
-The release command stages a separate manifest without build scripts, development
-dependencies, or patch declarations; the compiled bundle includes the wallet fixes.
-The destination directory must already exist.
+`package.json` `"files"` is the tarball. `prepack` runs `bun run build:all`.
+Publish with `bun publish`. Compile-time libraries are `devDependencies`;
+consumers get the bundled `dist/` files, not a second copy of the source tree.