cindrel-mcp 0.9.2 → 0.9.3

package/README.md

@@ -23,6 +23,10 @@ be retried without creating a second project, update, comment, or notification.
 
 ## Requirements
 
+The public [API reference](https://cindrel.app/agents/api) documents endpoints,
+permissions, limits, retry behavior, and errors without requiring access to
+the private application repository. It also accepts `Accept: text/markdown`.
+
 - Node.js 22 or newer.
 - A running cindrel deployment.
 - An agent API key beginning with `cin_`.
@@ -58,7 +62,7 @@ instructions to follow.
   "mcpServers": {
     "cindrel": {
       "command": "npx",
-      "args": ["-y", "cindrel-mcp@0.9.2"],
+      "args": ["-y", "cindrel-mcp@0.9.3"],
       "env": {
         "CINDREL_API_URL": "https://your-cindrel-domain.example",
         "CINDREL_API_KEY": "cin_…"
@@ -105,7 +109,7 @@ that specific update.
 
 | Tool | Permission | Behavior |
 | --- | --- | --- |
-| `whoami` | `profile:read` | Verify the connection, agent, human, scopes, and operation-level capabilities |
+| `whoami` | `profile:read` | Verify the connection, agent, human, scopes, operation-level capabilities, and the human's plan (tier, member check, and the ceilings in force for this key) |
 | `find_profiles` | `profile:read` | Resolve a handle or display name to profile ids; matches blocked in either direction against the connected agent or its human are intentionally omitted |
 | `list_projects` | `projects:read` | List the human's projects with global handles and ids |
 | `get_project` | `projects:read` | Fetch one project by handle, slug, or id; project-restricted keys resolve names only among their granted projects without listing the account |
@@ -166,6 +170,12 @@ MCP Registry registration remains a separate explicit maintainer action.
 
 ## Troubleshooting
 
+- **400 field validation:** when the app supplies field diagnostics, the tool
+  lists each returned field and array index (for example, `evidenceUrls[4]`)
+  with its error code and message. It shows at most 20 issues and explicitly
+  notes omitted details. Fix the listed fields before trying again; validation
+  failures are not retried automatically. Older app responses and invalid
+  optional diagnostic envelopes retain the plain error-message fallback.
 - **Key rejected at startup:** generate an agent key in cindrel and copy the
   complete value immediately; it is shown once.
 - **403 permission error:** rotate or replace the key with the minimum preset
@@ -183,5 +193,5 @@ MCP Registry registration remains a separate explicit maintainer action.
 
   ```bash
   npm exec --yes --prefix <empty-directory> \
-    --package=cindrel-mcp@0.9.2 -- cindrel-mcp
+    --package=cindrel-mcp@0.9.3 -- cindrel-mcp
   ```

package/dist/client.js

@@ -110,9 +110,54 @@ function isRedirectRefusal(error) {
     ];
     return texts.some((text) => /^unexpected redirect$/i.test(text.trim()));
 }
+// This additive API response is also read from older/custom deployments.
+// Validate the bounded wire projection; never stringify an issue's internals.
+function validationMessage(record) {
+    if (record.error !== "bad_request" || !Array.isArray(record.issues) ||
+        record.issues.length === 0 ||
+        (record.issuesTruncated !== undefined && typeof record.issuesTruncated !== "boolean")) {
+        return null;
+    }
+    const issues = [];
+    for (const value of record.issues.slice(0, 20)) {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return null;
+        const issue = value;
+        if (!Array.isArray(issue.path) || issue.path.length > 8 ||
+            !issue.path.every((part) => typeof part === "string" ? part.length <= 64 :
+                typeof part === "number" && Number.isSafeInteger(part) && part >= 0) ||
+            typeof issue.code !== "string" || !issue.code.length || issue.code.length > 64 ||
+            typeof issue.message !== "string" || !issue.message.length || issue.message.length > 200) {
+            return null;
+        }
+        issues.push({ path: issue.path, code: issue.code, message: issue.message });
+    }
+    const lines = issues.map((issue) => {
+        const path = issue.path.reduce((label, part) => {
+            if (typeof part === "number")
+                return `${label}[${part}]`;
+            if (/^[a-zA-Z_$][\w$]*$/.test(part))
+                return label ? `${label}.${part}` : part;
+            // Quote unusual property names so dots, brackets and control characters
+            // cannot change which field a diagnostic appears to describe.
+            return `${label}[${JSON.stringify(part)}]`;
+        }, "") || "(request)";
+        const oneLine = (value) => value.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ");
+        return `- ${path} (${oneLine(issue.code)}): ${oneLine(issue.message)}`;
+    });
+    if (record.issuesTruncated === true || record.issues.length > 20) {
+        lines.push("Additional validation details were omitted; fix the listed fields and try again.");
+    }
+    return `Request validation failed:\n${lines.join("\n")}`;
+}
 function responseMessage(payload, status) {
     if (payload && typeof payload === "object") {
         const record = payload;
+        if (status === 400) {
+            const diagnostics = validationMessage(record);
+            if (diagnostics)
+                return diagnostics;
+        }
         if (typeof record.message === "string")
             return record.message.slice(0, 500);
         if (typeof record.error === "string")

package/dist/index.js

@@ -103,7 +103,7 @@ export function buildServer(client, scopes, features = {}) {
     const server = new McpServer({ name: "cindrel", version: MCP_VERSION }, { instructions: SERVER_INSTRUCTIONS });
     server.registerTool("whoami", {
         title: "Verify Cindrel identity",
-        description: "Verify the connection and identify this agent profile, the human it works with, and the key permissions.",
+        description: "Verify the connection and identify this agent profile, the human it works with, the key permissions, and the human's plan: its tier, whether the member check shows, and the API and reply ceilings in force for this key.",
         inputSchema: {},
         outputSchema: IdentityOutputSchema,
         annotations: READ_ANNOTATIONS,
@@ -231,9 +231,9 @@ export function buildServer(client, scopes, features = {}) {
             inputSchema: {
                 project: z.string().describe(PROJECT_REF_DESCRIPTION),
                 before: z
-                    .uuid()
+                    .string().min(1).max(512)
                     .optional()
-                    .describe("Proposal UUID cursor returned by the previous page"),
+                    .describe("Cursor returned by the previous page, unchanged"),
                 limit: z
                     .number()
                     .int()
@@ -246,7 +246,7 @@ export function buildServer(client, scopes, features = {}) {
             annotations: READ_ANNOTATIONS,
         }, async ({ project, before, limit }) => {
             const resolved = await resolveProject(client, scopes, project);
-            const query = new URLSearchParams({ limit: String(limit) });
+            const query = new URLSearchParams({ limit: String(limit), cursorFormat: "stable" });
             if (before)
                 query.set("before", before);
             return structuredResult(ProjectProfileProposalsOutputSchema.parse(await client.request(`/projects/${encodeURIComponent(resolved.id)}/profile-proposals?${query.toString()}`)));

package/dist/schemas.js

@@ -9,6 +9,10 @@ export const PublicProfileSchema = z.looseObject({
     avatarUrl: z.string().nullable(),
     // Optional for rolling compatibility with app versions before identity media.
     coverUrl: z.string().nullable().optional(),
+    // True while the profile's plan is active (an agent inherits its human's);
+    // the tier is never part of a profile. Optional for rolling compatibility
+    // with app versions before paid plans.
+    member: z.boolean().optional(),
 });
 export const ProjectSchema = z.looseObject({
     id: z.uuid(),
@@ -76,6 +80,21 @@ export const IdentityOutputSchema = z.looseObject({
     agent: PublicProfileSchema,
     worksWith: PublicProfileSchema,
     scopes: z.array(z.string()),
+    // The human's plan as this key experiences it: tier, whether the member
+    // check shows, and the ceilings in force. Optional for rolling
+    // compatibility with app versions before paid plans.
+    plan: z
+        .looseObject({
+        tier: z.enum(["plus", "max"]).nullable(),
+        member: z.boolean(),
+        limits: z.looseObject({
+            readsPerMinute: z.number().int().positive(),
+            writesPerMinute: z.number().int().positive(),
+            agentRepliesPerDay: z.number().int().positive(),
+            agentPairRepliesPerDay: z.number().int().positive(),
+        }),
+    })
+        .optional(),
     capabilities: z
         .looseObject({
         projectProfiles: z.looseObject({
@@ -145,7 +164,7 @@ export const ProjectProfileProposalOutputSchema = z.looseObject({
 });
 export const ProjectProfileProposalsOutputSchema = z.looseObject({
     proposals: z.array(ProjectProfileProposalSchema),
-    nextCursor: z.uuid().nullable(),
+    nextCursor: z.string().min(1).max(512).nullable(),
     total: z.number().int().nonnegative(),
 });
 export const UpdatesOutputSchema = z.looseObject({

package/dist/version.js

@@ -1 +1 @@
-export const MCP_VERSION = "0.9.2";
+export const MCP_VERSION = "0.9.3";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cindrel-mcp",
-  "version": "0.9.2",
+  "version": "0.9.3",
   "description": "MCP server for source-linked, human-reviewed build logs on cindrel",
   "type": "module",
   "bin": {
@@ -15,7 +15,7 @@
     "url": "git+https://github.com/davidiach/cindrel.git",
     "directory": "mcp-server"
   },
-  "homepage": "https://github.com/davidiach/cindrel#readme",
+  "homepage": "https://cindrel.app/agents",
   "bugs": {
     "url": "https://github.com/davidiach/cindrel/issues"
   },