dokutrak-mcp 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -6,6 +6,23 @@ All notable changes to `dokutrak-mcp` are recorded here. The format follows
 is part of the public contract: it changes only with a decision recorded in
 the DokuTrak product repository, and every such change is listed here.
 
+## [0.1.1] — 2026-09-23
+
+Decision recorded in the DokuTrak product repository: ADR-014, amendment of
+2026-09-23 (dokutrak-product#577).
+
+### Changed
+
+- `create_request` asks before it sends. Its description tells the agent to
+  show the Professional the recipient email, the deadline, each document and
+  the message, and to call only once they have confirmed. The tool is now
+  annotated `destructiveHint: true` and `openWorldHint: true`, and carries
+  `_meta["anthropic/requiresUserInteraction"]: true`, so Claude Desktop and
+  Claude Code ask the Professional before every call.
+- `request_replacement` says that no immediate email to the Client exists,
+  not even from the dashboard. An agent had told a Professional otherwise.
+- The install skill asks for the message as well, and asks every time.
+
 ## [0.1.0] — 2026-09-14
 
 First public release. One complete round trip — ask, chase, know, collect —
@@ -38,4 +55,5 @@ as decided in ADR-014 of the DokuTrak product repository.
   management: the service refuses them to every Agent Connection, whatever
   the connector.
 
+[0.1.1]: https://github.com/Crackx17/dokutrak-mcp/releases/tag/v0.1.1
 [0.1.0]: https://github.com/Crackx17/dokutrak-mcp/releases/tag/v0.1.0

package/README.md

@@ -83,6 +83,18 @@ Then point the client at the built file instead of `npx`:
 
 or, for Claude Code: `claude mcp add dokutrak -e DOKUTRAK_API_KEY=dk_live_… -- node /path/to/dokutrak-mcp/dist/cli.js`.
 
+### The skill
+
+`skills/dokutrak/SKILL.md` teaches the agent the three everyday uses — ask a Client for
+documents, know where a request stands, chase on rejected files — and how to connect. It is
+what a DokuTrak user installs alongside the connector:
+
+```bash
+npx skills add Crackx17/dokutrak-mcp        # the open agent-skills installer
+# or by hand, for Claude Code / Claude Desktop:
+cp -r skills/dokutrak ~/.claude/skills/dokutrak
+```
+
 ## Configuration
 
 | Variable           | Required | Default                          | Meaning                                                    |
@@ -103,11 +115,19 @@ and to nobody else; the client uploads through the secure link it contains. Unde
 is the same two-step the DokuTrak app performs: create with `sendEmail: false`, then send. If the
 send fails, the error names the created request, which stays visible in the dashboard.
 
+**Nothing goes out without your yes.** The email to a real client cannot be recalled, so the tool
+tells the agent to show you the recipient, the deadline, the checklist and the message, and to
+wait for your confirmation. The tool is also flagged so that the client asks you before every
+call: Claude Code prompts each time, even in auto or bypass mode, and Claude Desktop treats it as
+a tool that always needs approval. A client that ignores these flags is left with the
+instruction to the agent alone.
+
 ### `request_replacement`
 
 Chases the client on the rejected files of a request: flags them, moves the request back to
 awaiting the client, and returns it to the automatic reminder cadence. **This call sends no
-email by itself**; the reminders do. The optional message is recorded in the request's audit
+email by itself**; the reminders do, and DokuTrak has no way to email the client immediately,
+not even from the dashboard. The optional message is recorded in the request's audit
 trail and is not sent to the client. It refuses a request with no rejected file.
 
 ### `get_request`

package/dist/cli.js

@@ -132,7 +132,7 @@ function jsonResult(value) {
 }
 
 // src/tools/create-request.ts
-var CREATE_REQUEST_DESCRIPTION = "Call this when the Professional wants to ask a Client for documents: it creates the Document Request and sends the email in one step, so nothing is left created but unsent. Provide the Client email, a deadline, and the list of documents wanted, plus an optional title and a message written by the Professional. The email goes to the recipient given here and to nobody else, and the Client uploads through the secure link it contains. If the email fails after creation, the error names the created request so it can be sent from the dashboard.";
+var CREATE_REQUEST_DESCRIPTION = "Call this when the Professional wants to ask a Client for documents: it creates the Document Request and emails the Client in one step, and that email cannot be recalled. Before calling, show the Professional the recipient email, the deadline, each document as the Client will read it, and the message if there is one, then call only once they have confirmed, even when the request already looks complete. The email goes to the recipient given here and to nobody else, and the Client uploads through the secure link it contains. If the email fails after creation, the error names the created request so it can be sent from the dashboard.";
 var registerCreateRequest = (server, api) => {
   server.registerTool(
     "create_request",
@@ -154,7 +154,13 @@ var registerCreateRequest = (server, api) => {
           })
         ).min(1).describe("The checklist the Client must fill.")
       },
-      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }
+      // An email to a real Client cannot be recalled, so the client asks the
+      // Professional on every call rather than trusting the description alone
+      // (dokutrak-product#577, ADR-014 amendment of 2026-09-23). Claude Desktop
+      // always prompts for a destructive tool; Claude Code prompts on every call
+      // for this key, auto and bypass modes included.
+      annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+      _meta: { "anthropic/requiresUserInteraction": true }
     },
     (input) => runTool(async () => {
       const created = await api.post("/v1/requests", {
@@ -198,7 +204,7 @@ function toDeadlineIso(deadline) {
 
 // src/tools/request-replacement.ts
 import { z as z2 } from "zod";
-var REQUEST_REPLACEMENT_DESCRIPTION = "Call this when a Document Request has rejected files and the Professional wants the Client to send them again. It flags every rejected file, moves the request back to awaiting the Client, and returns it to the automatic reminder cadence, which is what reaches the Client. Nothing is emailed by this call itself, and the optional message is kept in the audit trail rather than sent. Do not use it on a request with no rejected file; get_request shows which files were rejected.";
+var REQUEST_REPLACEMENT_DESCRIPTION = "Call this when a Document Request has rejected files and the Professional wants the Client to send them again. It flags every rejected file, moves the request back to awaiting the Client, and returns it to the automatic reminder cadence, which is what reaches the Client. Nothing is emailed by this call and there is no way to email the Client immediately, not even from the dashboard; the optional message is kept in the audit trail rather than sent. Do not use it on a request with no rejected file; get_request shows which files were rejected.";
 var registerRequestReplacement = (server, api) => {
   server.registerTool(
     "request_replacement",
@@ -384,7 +390,7 @@ var TOOL_REGISTRARS = [
 
 // src/server.ts
 var SERVER_NAME = "dokutrak";
-var SERVER_VERSION = "0.1.0";
+var SERVER_VERSION = "0.1.1";
 function createServer(options) {
   const api = createApiClient({
     baseUrl: options.baseUrl,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dokutrak-mcp",
   "mcpName": "io.github.Crackx17/dokutrak-mcp",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "MCP connector for DokuTrak: let your agent chase the documents.",
   "license": "MIT",
   "type": "module",