clipbait 1.7.0 → 1.8.0

package/README.md

@@ -22,7 +22,7 @@ Opens Clipbait so you can copy your key, then installs a `/clipbait` slash comma
 ### Claude Code
 
 ```bash
-claude mcp add --transport http clipbait https://app.clipbait.ai/api/mcp/cbk_live_your_key_here
+claude mcp add --transport http clipbait https://app.clipbait.ai/api/mcp --header "X-API-Key: cbk_live_your_key_here"
 ```
 
 ### Cursor / Cline / Windsurf / manual

package/index.js

@@ -13,6 +13,7 @@ const path = require("path");
 const CFG = path.join(os.homedir(), ".clipbait.json");
 const BASE = (process.env.CLIPBAIT_API_URL || "https://app.clipbait.ai/api").replace(/\/$/, "");
 const KEY_PAGE = "https://app.clipbait.ai/me";
+const MCP_URL = "https://app.clipbait.ai/api/mcp";
 
 // Shown whenever there's no usable key. Written so an AI agent can relay it
 // verbatim to the user and they'll know exactly what to do.
@@ -74,12 +75,14 @@ function prompt(question) {
 // reads MCP servers from ~/.claude.json under projects[cwd].mcpServers (local
 // scope) and, when present, a top-level mcpServers (user scope) — we write
 // both so it shows up regardless of which directory Claude opens in.
-function writeMcpConfig(mcpUrl) {
+function writeMcpConfig(key) {
   const cfgPath = path.join(os.homedir(), ".claude.json");
   let cfg;
   try { cfg = JSON.parse(fs.readFileSync(cfgPath, "utf8")); }
   catch { return false; } // no/unreadable config → caller prints manual steps
-  const entry = { type: "http", url: mcpUrl };
+  // Key travels in an X-API-Key header, not the URL path — keeps it out of the
+  // URL (and request logs). It still lives in the config file, same as any MCP.
+  const entry = { type: "http", url: MCP_URL, headers: { "X-API-Key": key } };
   cfg.mcpServers = cfg.mcpServers || {};
   cfg.mcpServers.clipbait = entry;
   const cwd = process.cwd();
@@ -143,55 +146,66 @@ function writeDesktopConfig(key) {
 // Interactive one-command setup. Grabs the key (from arg / saved / by opening
 // the browser and prompting), installs the /clipbait command, and connects the
 // MCP server to Claude Code and Claude Desktop.
+// Print the exact config for the user/agent to apply, WITHOUT touching any
+// files. Used in non-interactive contexts (an agent ran this): silently
+// rewriting global AI-tool config there reads as a supply-chain attack, so we
+// stay transparent and let the caller apply it with full visibility.
+function printManualConfig(key) {
+  console.log("\nTo connect Clipbait, apply one of these (nothing was written — you're not in an interactive terminal):\n");
+  console.log("Claude Code:");
+  console.log(`    claude mcp add --transport http clipbait ${MCP_URL} --header "X-API-Key: ${key}"\n`);
+  console.log("Claude Desktop / Cursor / Cline / Windsurf — add to the MCP config:");
+  console.log(`    ${JSON.stringify({ mcpServers: { clipbait: { command: "npx", args: ["-y", "clipbait@latest", "mcp"], env: { CLIPBAIT_API_KEY: key } } } })}\n`);
+  console.log(`Tip: run \`npx clipbait@latest\` in a real terminal to apply this automatically.\n`);
+}
+
 async function runSetup(providedKey) {
+  const interactive = !!process.stdin.isTTY;
   let key = providedKey && providedKey.startsWith("cbk_") ? providedKey : loadKey();
 
   if (!key) {
+    if (!interactive) { console.error(NEED_KEY); process.exit(1); }
     console.log("\n⚡ Let's connect Clipbait to Claude.");
-    if (!process.stdin.isTTY) {
-      // No interactive terminal (e.g. an AI agent ran this). Print the full
-      // guidance so the agent can pass it straight to the user.
-      console.error(NEED_KEY);
-      process.exit(1);
-    }
     console.log(`\nOpening ${KEY_PAGE} so you can copy your API key…`);
     openBrowser(KEY_PAGE);
     key = (await prompt("\nPaste your API key (starts with cbk_) and press Enter:\n> ")).trim();
   }
+  if (!key || !key.startsWith("cbk_")) { console.error(NEED_KEY); process.exit(1); }
 
-  if (!key || !key.startsWith("cbk_")) {
-    console.error(NEED_KEY);
-    process.exit(1);
-  }
+  // Non-interactive (agent / pipe): don't silently modify global config. Print
+  // it and let the caller apply it with consent.
+  if (!interactive) { printManualConfig(key); return; }
+
+  // Interactive: announce exactly what will change BEFORE writing anything, so
+  // it never looks like a package quietly registering itself.
+  console.log("\n⚡ Clipbait setup will make these changes on this machine:");
+  console.log("  • save your API key to ~/.clipbait.json");
+  console.log("  • install a /clipbait slash command (~/.claude/commands/clipbait.md)");
+  console.log("  • register the Clipbait MCP server in Claude Code (~/.claude.json)");
+  console.log("  • register it in Claude Desktop, if installed\n");
 
   fs.writeFileSync(CFG, JSON.stringify({ apiKey: key }, null, 2));
-  const mcpUrl = "https://app.clipbait.ai/api/mcp/" + key;
 
-  // 1) Install the /clipbait slash command for Claude Code.
   const cmdDir = path.join(os.homedir(), ".claude", "commands");
   fs.mkdirSync(cmdDir, { recursive: true });
   fs.writeFileSync(path.join(cmdDir, "clipbait.md"), SLASH_COMMAND);
   console.log("✓ Installed the /clipbait command for Claude Code");
 
-  // 2) Register the MCP server with Claude Code. Prefer editing the config
-  // file directly (works everywhere); fall back to the `claude` CLI, then to
-  // printing manual steps.
-  if (writeMcpConfig(mcpUrl)) {
-    console.log("✓ Connected the Clipbait MCP server to Claude Code");
+  if (writeMcpConfig(key)) {
+    console.log("✓ Registered the Clipbait MCP server in Claude Code");
   } else {
     const { spawnSync } = require("child_process");
-    const r = spawnSync("claude", ["mcp", "add", "--transport", "http", "clipbait", mcpUrl], { stdio: "ignore" });
+    const r = spawnSync("claude", ["mcp", "add", "--transport", "http", "clipbait", MCP_URL, "--header", `X-API-Key: ${key}`], { stdio: "ignore" });
     if (!r.error && r.status === 0) {
-      console.log("✓ Connected the Clipbait MCP server to Claude Code");
+      console.log("✓ Registered the Clipbait MCP server in Claude Code");
     } else {
-      console.log("• Couldn't auto-connect the MCP server. Add it manually:");
-      console.log("    claude mcp add --transport http clipbait " + mcpUrl);
+      console.log("• Couldn't auto-register the MCP server. Add it manually:");
+      console.log(`    claude mcp add --transport http clipbait ${MCP_URL} --header "X-API-Key: ${key}"`);
     }
   }
 
-  // 3) Also configure Claude Desktop if installed (stdio server → download_clip).
   if (writeDesktopConfig(key)) {
-    console.log("✓ Connected Clipbait to Claude Desktop (quit + reopen it to load)");
+    console.log("✓ Registered Clipbait in Claude Desktop (quit + reopen it to load)");
   }
 
   console.log("\n🎬 Done! Restart Claude Code, then type:\n    /clipbait https://youtube.com/watch?v=…\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clipbait",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Clipbait CLI + MCP server — turn any video into viral clips, and auto-clip live streams, from your terminal or any AI agent.",
   "bin": { "clipbait": "index.js" },
   "type": "commonjs",