dokutrak-mcp 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -6,6 +6,23 @@ All notable changes to `dokutrak-mcp` are recorded here. The format follows
 is part of the public contract: it changes only with a decision recorded in
 the DokuTrak product repository, and every such change is listed here.
 
+## [Unreleased]
+
+## [0.1.2] — 2026-10-14
+
+### Added
+
+- The hosted connector, `https://app.dokutrak.com/api/mcp`, listed as a
+  remote in the MCP Registry entry next to the npm package. It is operated by
+  the DokuTrak service (OAuth, prepare / confirm / send / track) and is not
+  part of this package; see the README.
+- An MCP Bundle, `dokutrak.mcpb`: one-click install in Claude Desktop, the
+  Agent Connection asked for at install and stored as a sensitive setting.
+  `npm run bundle` builds it (`mcpb/manifest.json`, dependencies inlined in
+  one file), checks it against the running server and packs it; the release
+  workflow attaches it to each GitHub release. The npm package is unchanged.
+- A Privacy Policy section in the README.
+
 ## [0.1.1] — 2026-09-23
 
 Decision recorded in the DokuTrak product repository: ADR-014, amendment of
@@ -55,5 +72,6 @@ as decided in ADR-014 of the DokuTrak product repository.
   management: the service refuses them to every Agent Connection, whatever
   the connector.
 
+[0.1.2]: https://github.com/Crackx17/dokutrak-mcp/releases/tag/v0.1.2
 [0.1.1]: https://github.com/Crackx17/dokutrak-mcp/releases/tag/v0.1.1
 [0.1.0]: https://github.com/Crackx17/dokutrak-mcp/releases/tag/v0.1.0

package/README.md

@@ -22,7 +22,19 @@ configuration with your key already in place; the instructions below are the sam
 The key is read from the environment variable `DOKUTRAK_API_KEY`. It is never taken from the
 command line.
 
-### Claude Desktop
+### Install in Claude Desktop (one click)
+
+1. Download [`dokutrak.mcpb`](https://github.com/Crackx17/dokutrak-mcp/releases/latest/download/dokutrak.mcpb),
+   the connector packaged as an [MCP Bundle](https://github.com/modelcontextprotocol/mcpb).
+2. Double-click it, or drag it onto Claude Desktop (**Settings → Extensions**).
+3. Click **Install** and paste your Agent Connection key when asked. Claude Desktop masks it, stores it
+   securely and passes it to the connector as `DOKUTRAK_API_KEY`.
+
+The bundle carries its own copy of the connector and runs on the Node.js built into Claude
+Desktop: no `npx`, no configuration file to edit. `npm run bundle` builds the same file from a
+clone.
+
+### Claude Desktop, by hand
 
 Open the configuration file:
 
@@ -53,11 +65,13 @@ claude mcp add dokutrak -e DOKUTRAK_API_KEY=dk_live_… -- npx -y dokutrak-mcp
 
 Then `/mcp` inside Claude Code lists `dokutrak` and its tools.
 
-### claude.ai
+### claude.ai and ChatGPT (hosted)
 
-**Not supported in this release.** claude.ai connects to remote MCP servers over HTTP with
-OAuth; this connector speaks stdio with an API key, which is what a local install into Claude
-Desktop or Claude Code needs. A hosted variant is a separate, later decision.
+Add `https://app.dokutrak.com/api/mcp` as a custom connector. You sign in to DokuTrak
+(or create an account) during the OAuth step. The hosted connector prepares a request,
+sends it only after you confirm it in DokuTrak, and tracks progress. It never returns
+file content. Downloading files stays with this local connector. Setup:
+[dokutrak.com/connectors](https://dokutrak.com/connectors).
 
 ### From a clone, before the npm release
 
@@ -155,6 +169,19 @@ connector asks. The same goes for billing, workspace settings and the management
 Revoking the Agent Connection in DokuTrak takes effect on the very next call: the connector
 answers with the service's 401 and nothing else.
 
+## Privacy Policy
+
+The connector runs on your machine and talks to one service only: the DokuTrak API
+(`https://app.dokutrak.com/api`, or the URL you set in `DOKUTRAK_API_URL`), with the Agent
+Connection you configured. It sends what the tools need (the request you create, the id or
+search term you look up) and relays the answers to your agent. It writes nothing to disk, keeps
+no cache or log, and sends no telemetry or analytics to DokuTrak or to anyone else.
+
+Everything it sends is processed by DokuTrak under the [DokuTrak Privacy
+Policy](https://dokutrak.com/privacy), which covers what is collected, how it is used and
+stored, the subprocessors it is shared with, retention and deletion, and your rights. Questions:
+arthur@dokutrak.com; security issues: security@dokutrak.com.
+
 ## Development
 
 ```bash
@@ -183,6 +210,15 @@ DOKUTRAK_API_KEY=dk_live_… STAGING_RECIPIENT_EMAIL=you@example.com npm run sta
 A real Document Request is created and a real email goes to `STAGING_RECIPIENT_EMAIL`. The
 transcript lands in `staging-run-<timestamp>.md` (git-ignored); the key is never written to it.
 
+### The MCP Bundle
+
+`npm run bundle` builds `mcpb/server/index.cjs` (the connector with every dependency inlined),
+starts it and checks that it lists exactly the tools declared in `mcpb/manifest.json` at the
+version of `package.json`, then validates the manifest and packs `dokutrak.mcpb` with the
+official [`mcpb`](https://github.com/modelcontextprotocol/mcpb) CLI. CI runs it on every pull
+request, and the release workflow attaches `dokutrak.mcpb` to the GitHub release of each tag.
+A change to the tool surface or the version updates `mcpb/manifest.json` too.
+
 ### Releasing
 
 A tag `vX.Y.Z` matching `package.json` and `SERVER_VERSION` triggers `.github/workflows/release.yml`:

package/dist/cli.js

@@ -390,7 +390,7 @@ var TOOL_REGISTRARS = [
 
 // src/server.ts
 var SERVER_NAME = "dokutrak";
-var SERVER_VERSION = "0.1.1";
+var SERVER_VERSION = "0.1.2";
 function createServer(options) {
   const api = createApiClient({
     baseUrl: options.baseUrl,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dokutrak-mcp",
   "mcpName": "io.github.Crackx17/dokutrak-mcp",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "MCP connector for DokuTrak: let your agent chase the documents.",
   "license": "MIT",
   "type": "module",
@@ -23,7 +23,8 @@
     "test": "vitest run",
     "check": "npm run typecheck && npm run build && npm test",
     "prepublishOnly": "npm run check",
-    "staging": "node scripts/staging-run.mjs"
+    "staging": "node scripts/staging-run.mjs",
+    "bundle": "tsup --config tsup.mcpb.config.ts && node scripts/check-bundle-manifest.mjs && npx --yes @anthropic-ai/mcpb@2.1.2 validate mcpb/manifest.json && npx --yes @anthropic-ai/mcpb@2.1.2 pack mcpb dokutrak.mcpb"
   },
   "repository": {
     "type": "git",