gameye-mcp 0.3.1 → 0.3.2

package/README.md

@@ -1,5 +1,7 @@
 # Gameye MCP Server
 
+[![Discord](https://img.shields.io/badge/Discord-join%20chat-5865F2?logo=discord&logoColor=white)](https://discord.com/invite/QvJ3KH5max)
+
 A [Model Context Protocol](https://modelcontextprotocol.io) server for the [Gameye](https://gameye.com) game server orchestration API. It lets an AI agent (Claude Code, Claude Desktop, Cursor, or any MCP client) launch and inspect game server sessions, check image tags and regions, and fetch logs and artifacts. You talk to it in plain language, and you don't have to leave your editor.
 
 > **Status: beta** (`0.x`). Tools, inputs and outputs may change between releases, and there may be bugs. The server says so to every client that connects, on startup, and in `gameye_context`. It is published on npm as [`gameye-mcp`](https://www.npmjs.com/package/gameye-mcp), as a container image at `ghcr.io/gameye/gameye-mcp`, and in the [MCP Registry](https://registry.modelcontextprotocol.io) as `io.github.Gameye/gameye-mcp`; see the [changelog](https://github.com/Gameye/gameye-mcp/blob/main/CHANGELOG.md) for what changed in each release.
@@ -30,6 +32,7 @@ The environment is a property of the server process. No tool takes an environmen
 | `GAMEYE_API_TOKEN` | **Yes** | — | Gameye API token. Use the least-privileged scopes you need (see below). |
 | `GAMEYE_ENV` | No | `sandbox` | `sandbox` or `production`. Selects the API host. |
 | `GAMEYE_API_URL` | No | — | Overrides the host, for testing only. Must be `https`. If it equals one of the two known hosts, it must match `GAMEYE_ENV` or the server refuses to start. Any other URL is labelled `custom` in every tool result. |
+| `GAMEYE_ENABLE_SKILLS_UPDATE` | No | — | Set to `1` to let `gameye_update_skills` run the skills updaters with `apply: true`. Without it the tool only checks and lists the commands. |
 | `GAMEYE_TIMEOUT_MS` | No | `30000` | Per-request timeout in milliseconds, a positive whole number. Log snapshots get at least 60 s and artifact downloads at least 120 s. A request that runs out of time comes back as a tool error: `Request to <host> timed out after <n>s`. |
 
 ## Install
@@ -63,7 +66,7 @@ Most clients (Claude Desktop, Cursor, Windsurf and others) accept an `mcpServers
 
 Restart the client after you change its configuration.
 
-`npx -y gameye-mcp` runs the latest release. To stay on one version, name it: `npx -y gameye-mcp@0.3.1` (or `"args": ["-y", "gameye-mcp@0.3.1"]`).
+`npx -y gameye-mcp` runs the latest release. To stay on one version, name it: `npx -y gameye-mcp@0.3.2` (or `"args": ["-y", "gameye-mcp@0.3.2"]`).
 
 ### Windows
 
@@ -105,7 +108,7 @@ With Claude Code: `claude mcp add gameye --env GAMEYE_API_TOKEN=<your-token> --
 
 - Pass each variable with `-e NAME` (no value), so Docker copies it from the client's environment and the token never appears in the command line.
 - Keep `-i` and never add `-t`: a terminal mangles the JSON-RPC messages on stdout.
-- To stay on one version, use a version tag such as `ghcr.io/gameye/gameye-mcp:0.3.1`.
+- To stay on one version, use a version tag such as `ghcr.io/gameye/gameye-mcp:0.3.2`.
 - Files the server writes stay inside the container, and `--rm` deletes them:
   - `gameye_get_artifacts` saves its download under the temp directory. To keep it, mount a directory and point the temp directory at it: `-v /absolute/dir:/out -e TMPDIR=/out`. The path the tool reports is the container path; the file is in `/absolute/dir` on the host.
   - `gameye_create_token` writes to the `outputPath` you give it. Mount a directory the same way and pass an `outputPath` under `/out`.
@@ -172,7 +175,7 @@ The [Gameye skills](https://github.com/gameye/gameye-skills) change as the Gamey
 - **skills CLI, this project:** the same, in `skills-lock.json` in the server's working directory.
 - **Claude Code plugin:** `gameye@gameye` in `~/.claude/plugins/installed_plugins.json`.
 
-Without `apply` it only reports. With `apply: true` it runs each outdated install's own updater: `npx -y skills update <the Gameye skills> -g -y` (or `-p -y`), or `claude plugin marketplace update gameye` then `claude plugin update gameye@gameye`. It only updates skills whose lock-file source is `gameye/gameye-skills`, and it never downloads or follows skill text itself. Each command runs with stdin closed and a 90-second limit. On Windows it prints the commands instead of running them. The running agent session keeps the skills it loaded; the next session uses the update. The `gameye` skill tells agents to run the check once per conversation and ask before applying.
+Without `apply` it only reports. With `apply: true`, and only when the server was started with `GAMEYE_ENABLE_SKILLS_UPDATE=1`, it runs each outdated install's own updater: `npx -y skills@1.7.4 update <the Gameye skills> -g -y` (or `-p -y`), or `claude plugin marketplace update gameye` then `claude plugin update gameye@gameye`. Otherwise it lists those commands for you to run. The updaters get a minimal environment: paths, home, temp, locale, proxy and CA settings and npm and Claude config, never `GAMEYE_*` variables or anything named like a token, secret, password or key. It only updates skills whose lock-file source is `gameye/gameye-skills`, and it never downloads or follows skill text itself. Each command runs with stdin closed and a 90-second limit. On Windows it prints the commands instead of running them. The running agent session keeps the skills it loaded; the next session uses the update. The `gameye` skill tells agents to run the check once per conversation and ask before applying.
 
 ## Telemetry/attribution
 

package/dist/skills.d.ts

@@ -1,5 +1,11 @@
 /** Where the `gameye` skill's `Pack version:` line is published. */
 export declare const LATEST_PACK_URL = "https://raw.githubusercontent.com/Gameye/gameye-skills/main/skills/gameye/SKILL.md";
+/** The skills CLI the updater runs, pinned so `npx` never fetches whatever is newest. */
+export declare const SKILLS_CLI = "skills@1.7.4";
+/** Set to 1 to let `gameye_update_skills` run updaters; otherwise apply prints the commands. */
+export declare const ENABLE_UPDATE_ENV = "GAMEYE_ENABLE_SKILLS_UPDATE";
+/** The environment an updater runs with: the allowlist above, no Gameye variables, nothing that looks like a secret. */
+export declare function childEnv(parent: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 /** How the Gameye skills were installed. Each kind updates differently. */
 export type InstallKind = "skills-cli-global" | "skills-cli-project" | "claude-plugin";
 export interface SkillsInstall {
@@ -14,6 +20,8 @@ export interface SkillsEnv {
     home: string;
     cwd: string;
     platform: NodeJS.Platform;
+    /** The operator set GAMEYE_ENABLE_SKILLS_UPDATE=1: apply may run updaters. */
+    applyEnabled: boolean;
     readText: (path: string) => Promise<string | undefined>;
     fetchText: (url: string) => Promise<string>;
     run: (cmd: string, args: string[], cwd: string) => Promise<string>;

package/dist/skills.js

@@ -8,11 +8,39 @@ const PACK_VERSION_RE = /^Pack version: (\d+\.\d+\.\d+)[ \t]*$/m;
 const SKILLS_SOURCE_RE = /^(https:\/\/github\.com\/|git@github\.com:|github:)?gameye\/gameye-skills(\.git)?\/?$/i;
 // Lock files can come from a cloned project, so a name must look like a skill name, never a CLI option.
 const SKILL_NAME_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/i;
+/** The skills CLI the updater runs, pinned so `npx` never fetches whatever is newest. */
+export const SKILLS_CLI = "skills@1.7.4";
+/** Set to 1 to let `gameye_update_skills` run updaters; otherwise apply prints the commands. */
+export const ENABLE_UPDATE_ENV = "GAMEYE_ENABLE_SKILLS_UPDATE";
+// What an updater needs from the parent: where to find programs and home, temp dirs, locale,
+// proxy and CA settings, npm and Claude config. Nothing else is passed, so the Gameye token stays here.
+const CHILD_ENV_NAMES = new Set([
+    "PATH", "Path", "PATHEXT", "HOME", "USERPROFILE", "APPDATA", "LOCALAPPDATA", "HOMEDRIVE", "HOMEPATH",
+    "SystemRoot", "SYSTEMROOT", "ComSpec", "COMSPEC", "WINDIR", "TEMP", "TMP", "TMPDIR",
+    "USER", "LOGNAME", "SHELL", "LANG", "LC_ALL", "TERM",
+    "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY", "http_proxy", "https_proxy", "no_proxy",
+    "NODE_EXTRA_CA_CERTS", "SSL_CERT_FILE", "SSL_CERT_DIR", "CLAUDE_CONFIG_DIR",
+]);
+const CHILD_ENV_PREFIXES = ["XDG_", "npm_config_", "NPM_CONFIG_"];
+// Never passed, even under an allowed prefix: an npm registry token is not the updater's business either.
+const SECRET_NAME_RE = /token|secret|password|passwd|auth|key|credential/i;
+/** The environment an updater runs with: the allowlist above, no Gameye variables, nothing that looks like a secret. */
+export function childEnv(parent) {
+    const env = {};
+    for (const [name, value] of Object.entries(parent)) {
+        if (value === undefined || name.toUpperCase().startsWith("GAMEYE_") || SECRET_NAME_RE.test(name))
+            continue;
+        if (CHILD_ENV_NAMES.has(name) || CHILD_ENV_PREFIXES.some((p) => name.startsWith(p)))
+            env[name] = value;
+    }
+    return { ...env, NO_COLOR: "1", FORCE_COLOR: "0", CI: "1" };
+}
 export function defaultSkillsEnv() {
     return {
         home: homedir(),
         cwd: process.cwd(),
         platform: process.platform,
+        applyEnabled: process.env[ENABLE_UPDATE_ENV] === "1",
         readText: (path) => readFile(path, "utf8").catch(() => undefined),
         fetchText: async (url) => {
             const res = await fetch(url, { signal: AbortSignal.timeout(5_000) });
@@ -21,8 +49,7 @@ export function defaultSkillsEnv() {
             return res.text();
         },
         run: (cmd, args, cwd) => new Promise((resolve, reject) => {
-            const childEnv = { ...process.env, NO_COLOR: "1", FORCE_COLOR: "0", CI: "1" };
-            const options = { cwd, env: childEnv, timeout: 90_000, killSignal: "SIGKILL", maxBuffer: 4 * 1024 * 1024 };
+            const options = { cwd, env: childEnv(process.env), timeout: 90_000, killSignal: "SIGKILL", maxBuffer: 4 * 1024 * 1024 };
             const child = execFile(cmd, args, options, (err, stdout, stderr) => {
                 const out = stripAnsi(`${stdout}${stderr}`).trim();
                 if (err)
@@ -120,9 +147,9 @@ export function isOutdated(install, latest) {
 export function updateCommands(install) {
     switch (install.kind) {
         case "skills-cli-global":
-            return [["npx", "-y", "skills", "update", ...install.skills, "-g", "-y"]];
+            return [["npx", "-y", SKILLS_CLI, "update", ...install.skills, "-g", "-y"]];
         case "skills-cli-project":
-            return [["npx", "-y", "skills", "update", ...install.skills, "-p", "-y"]];
+            return [["npx", "-y", SKILLS_CLI, "update", ...install.skills, "-p", "-y"]];
         case "claude-plugin":
             return [
                 ["claude", "plugin", "marketplace", "update", "gameye"],

package/dist/tools/skills.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { defineTool } from "./common.js";
-import { compareVersions, defaultSkillsEnv, describeInstall, fetchLatestPackVersion, findSkillsInstalls, isOutdated, updateCommands, } from "../skills.js";
+import { compareVersions, defaultSkillsEnv, describeInstall, ENABLE_UPDATE_ENV, fetchLatestPackVersion, findSkillsInstalls, isOutdated, updateCommands, } from "../skills.js";
 const RELOAD_NOTE = "The running session keeps the skills it already loaded. Start a new session (in Claude Code, /reload-plugins also works for the plugin) to use the update.";
 export function registerSkillsTools(server, ctx, env = defaultSkillsEnv()) {
     defineTool(server, ctx, "gameye_update_skills", {
@@ -8,7 +8,8 @@ export function registerSkillsTools(server, ctx, env = defaultSkillsEnv()) {
         description: "Compare the installed Gameye agent skills with the latest pack on GitHub, and update them. " +
             "Finds installs made with the skills CLI (user-wide or in this project) and the Claude Code plugin gameye@gameye. " +
             "Without apply it only checks and changes nothing. With apply=true it runs each outdated install's own updater " +
-            "(npx skills update for the Gameye skills only, or claude plugin update); ask the user before applying. " +
+            "(npx skills update for the Gameye skills only, or claude plugin update) when the operator set " +
+            `${ENABLE_UPDATE_ENV}=1; otherwise it lists the commands for the user to run. Ask the user before applying. ` +
             "Updates come only through those package managers; this tool never downloads or follows skill text itself.",
         inputSchema: {
             apply: z
@@ -56,8 +57,15 @@ export function registerSkillsTools(server, ctx, env = defaultSkillsEnv()) {
         if (outdated.length === 0)
             return lines.join("\n");
         const commands = outdated.flatMap(updateCommands);
-        if (!apply || env.platform === "win32") {
-            lines.push("", apply ? "Updating from this server isn't supported on Windows. Run:" : "Call again with apply=true to run:");
+        if (!apply || env.platform === "win32" || !env.applyEnabled) {
+            const why = !apply
+                ? env.applyEnabled
+                    ? "Call again with apply=true to run:"
+                    : "Run:"
+                : env.platform === "win32"
+                    ? "Updating from this server isn't supported on Windows. Run:"
+                    : `Updating from this server is off (set ${ENABLE_UPDATE_ENV}=1 in the server's environment to allow it). Run:`;
+            lines.push("", why);
             for (const cmd of commands)
                 lines.push(`  ${cmd.join(" ")}`);
             return lines.join("\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gameye-mcp",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "mcpName": "io.github.Gameye/gameye-mcp",
   "description": "MCP server for the Gameye game server orchestration API: launch and inspect sessions, check image tags, fetch logs and artifacts from any MCP client",
   "main": "dist/index.js",
@@ -48,7 +48,7 @@
   },
   "type": "module",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "zod": "^4.3.6"
   },
   "devDependencies": {