creditkarma-mcp 2.0.2 → 2.0.4

package/README.md

@@ -85,11 +85,11 @@ Credit Karma uses short-lived JWTs. This server handles automatic token refresh
 #### Option A — scripted (recommended)
 
 ```bash
-npm run auth               # prints the Cookie header to the console
-npm run auth -- .env       # writes CK_COOKIES=<header> to .env
+npm run auth               # prints the CKAT value to the console
+npm run auth -- .env       # writes CK_COOKIES=<ckat> to .env
 ```
 
-Launches Chrome with a dedicated profile at `~/.creditkarma-mcp/chrome-profile`, waits for you to sign in at creditkarma.com, then captures the full Cookie header (including the `CKAT` cookie that holds the access + refresh JWTs). Either prints it (for pasting into Claude Desktop / MCPB) or writes it to the env file you pass. Requires Google Chrome installed locally; the script installs `puppeteer-core` on first run (~1 MB).
+Launches Chrome with a dedicated profile at `~/.creditkarma-mcp/chrome-profile`, waits for you to sign in at creditkarma.com, then captures the `CKAT` cookie (the URL-encoded bundle of access + refresh JWTs). Either prints it (for pasting into Claude Desktop / MCPB) or writes it to the env file you pass. Requires Google Chrome installed locally; the script installs `puppeteer-core` on first run (~1 MB).
 
 #### Option B — manual (DevTools)
 

package/SKILL.md

@@ -60,11 +60,11 @@ Or use a `.env` file in the project directory with `CK_COOKIES=<value>`.
 
 **Scripted (recommended — source install):**
 ```bash
-npm run auth               # prints the Cookie header to the console
-npm run auth -- .env       # writes CK_COOKIES=<header> to .env
+npm run auth               # prints the CKAT value to the console
+npm run auth -- .env       # writes CK_COOKIES=<ckat> to .env
 ```
 
-Launches Chrome with a dedicated profile, waits for sign-in at creditkarma.com, then captures the full Cookie header. Use the printed value with Claude Desktop / MCPB, or the `.env` form when running from source.
+Launches Chrome with a dedicated profile, waits for sign-in at creditkarma.com, then captures the `CKAT` cookie (the URL-encoded bundle of access + refresh JWTs). Use the printed value with Claude Desktop / MCPB, or the `.env` form when running from source.
 
 **Manual (DevTools):**
 1. Log in to [creditkarma.com](https://www.creditkarma.com) in Chrome

package/dist/bundle.js

@@ -30831,10 +30831,19 @@ function registerSqlTools(server, ctx) {
 }
 
 // src/index.ts
+function readVar(key) {
+  const raw = process.env[key];
+  if (typeof raw !== "string") return void 0;
+  const trimmed = raw.trim();
+  if (trimmed.length === 0) return void 0;
+  if (trimmed === "undefined" || trimmed === "null") return void 0;
+  if (/^\$\{[^}]*\}$/.test(trimmed)) return void 0;
+  return trimmed;
+}
 var __dirname = dirname4(fileURLToPath2(import.meta.url));
 try {
   const { config: config2 } = await import("dotenv");
-  config2({ path: join3(__dirname, "..", ".env"), override: false });
+  config2({ path: join3(__dirname, "..", ".env"), override: false, quiet: true });
 } catch {
 }
 function extractCookieValue3(cookieString, name) {
@@ -30842,9 +30851,9 @@ function extractCookieValue3(cookieString, name) {
   return match ? match[1] : void 0;
 }
 async function main() {
-  const dbPath = process.env.CK_DB_PATH || join3(homedir(), ".creditkarma-mcp", "transactions.db");
+  const dbPath = readVar("CK_DB_PATH") || join3(homedir(), ".creditkarma-mcp", "transactions.db");
   const mcpJsonPath = join3(__dirname, "..", ".mcp.json");
-  const cookies = process.env.CK_COOKIES || void 0;
+  const cookies = readVar("CK_COOKIES") || void 0;
   let token;
   let refreshToken;
   if (cookies) {
@@ -30859,7 +30868,7 @@ async function main() {
     mcpJsonPath
   };
   const server = new McpServer(
-    { name: "creditkarma-mcp", version: "2.0.2" }
+    { name: "creditkarma-mcp", version: "2.0.4" }
   );
   registerAuthTools(server, ctx);
   registerSyncTools(server, ctx);

package/dist/index.js

@@ -9,11 +9,29 @@ import { registerAuthTools } from './tools/auth.js';
 import { registerSyncTools } from './tools/sync.js';
 import { registerQueryTools } from './tools/query.js';
 import { registerSqlTools } from './tools/sql.js';
+/**
+ * Read an env var, trim whitespace, and treat as unset if blank or if the value
+ * looks like an unsubstituted shell placeholder (e.g. `${FOO}`) — defends
+ * against MCP hosts that pass .mcp.json env blocks through unexpanded.
+ */
+function readVar(key) {
+    const raw = process.env[key];
+    if (typeof raw !== 'string')
+        return undefined;
+    const trimmed = raw.trim();
+    if (trimmed.length === 0)
+        return undefined;
+    if (trimmed === 'undefined' || trimmed === 'null')
+        return undefined;
+    if (/^\$\{[^}]*\}$/.test(trimmed))
+        return undefined;
+    return trimmed;
+}
 const __dirname = dirname(fileURLToPath(import.meta.url));
 // Load .env for local dev; silently skip if dotenv is unavailable (e.g. mcpb bundle)
 try {
     const { config } = await import('dotenv');
-    config({ path: join(__dirname, '..', '.env'), override: false });
+    config({ path: join(__dirname, '..', '.env'), override: false, quiet: true });
 }
 catch {
     // not available — rely on process.env (mcpb sets credentials via mcp_config.env)
@@ -23,9 +41,9 @@ function extractCookieValue(cookieString, name) {
     return match ? match[1] : undefined;
 }
 async function main() {
-    const dbPath = process.env.CK_DB_PATH || join(homedir(), '.creditkarma-mcp', 'transactions.db');
+    const dbPath = readVar('CK_DB_PATH') || join(homedir(), '.creditkarma-mcp', 'transactions.db');
     const mcpJsonPath = join(__dirname, '..', '.mcp.json');
-    const cookies = process.env.CK_COOKIES || undefined;
+    const cookies = readVar('CK_COOKIES') || undefined;
     // Bootstrap tokens from CK_COOKIES: accepts raw CKAT, CKAT=<value>, or full cookie string
     let token;
     let refreshToken;
@@ -40,7 +58,7 @@ async function main() {
         db: initDb(dbPath),
         mcpJsonPath
     };
-    const server = new McpServer({ name: 'creditkarma-mcp', version: '2.0.2' });
+    const server = new McpServer({ name: 'creditkarma-mcp', version: '2.0.4' });
     registerAuthTools(server, ctx);
     registerSyncTools(server, ctx);
     registerQueryTools(server, ctx);

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "creditkarma-mcp",
-  "version": "2.0.2",
+  "version": "2.0.4",
+  "mcpName": "io.github.chrischall/creditkarma-mcp",
   "description": "MCP server for Credit Karma — natural-language access to your transactions, spending, and accounts",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
   "repository": {
@@ -28,7 +29,8 @@
   },
   "files": [
     "dist",
-    "SKILL.md"
+    "SKILL.md",
+    "server.json"
   ],
   "scripts": {
     "build": "tsc && cp src/transaction.graphql dist/ && npm run bundle",

package/server.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.chrischall/creditkarma-mcp",
+  "description": "Credit Karma transactions for Claude — spending by category, merchant, and account summary",
+  "repository": {
+    "url": "https://github.com/chrischall/creditkarma-mcp",
+    "source": "github"
+  },
+  "version": "2.0.4",
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "creditkarma-mcp",
+      "version": "2.0.4",
+      "transport": {
+        "type": "stdio"
+      },
+      "environmentVariables": [
+        {
+          "name": "CK_COOKIES",
+          "description": "Your Credit Karma Cookie header (run `npm run auth` to capture via browser login, or copy CKAT from DevTools)",
+          "isRequired": false,
+          "format": "string",
+          "isSecret": true
+        }
+      ]
+    }
+  ]
+}