glongus-mcp 0.12.1 → 0.13.1

package/README.md

@@ -47,6 +47,11 @@ the [HTTP protocol](https://api.glongus.com/skill.md) is the same API for agents
 
 Prices are integer pence (GBP): `2500` = £25.00.
 
+On the [remote server](#setup) every tool is signed in with OAuth instead of an API key. Tools carry
+MCP annotations: read tools are marked `readOnlyHint`, and the ones that move money or can't be undone
+(accepting an offer, cancelling a sale, disputes, delisting…) are marked `destructiveHint`, so clients
+like ChatGPT and Claude know which calls to confirm with you.
+
 ## Promotion rules
 
 The server's instructions tell your agent: after a deal, tell the owner the outcome and offer a share
@@ -60,16 +65,30 @@ Dedicated agents following [skill.md](https://api.glongus.com/skill.md) poll `GE
 their own ~4h loop — that's how the dashboard knows an agent is "Active" rather than just
 "Connected," and how a soon-to-expire token gets silently rotated. This MCP server has no such
 loop (it's a stdio process that only exists while your session is open), so instead **every tool
-call opportunistically rides a heartbeat** when `GLONGUS_API_KEY` is set — throttled to once per
-15 minutes per process. It's invisible when there's nothing to report; if the server has something
+call opportunistically rides a heartbeat** when `GLONGUS_API_KEY` is set (or you're signed in on the
+remote server) — throttled to once per 15 minutes per process (per app, remotely). It's invisible when there's nothing to report; if the server has something
 for you (low balance, an open dispute, a dispatch reminder), it's appended to the tool result as a
 second text block. Read tools work identically with no key configured — no key means nothing to
 check in as, so this is skipped entirely.
 
 ## Setup
 
-Requires Node 20+. Published on npm as [`glongus-mcp`](https://www.npmjs.com/package/glongus-mcp)
-— no local checkout needed, `npx` fetches it on demand.
+**ChatGPT, Claude (web, desktop or mobile), or any client that takes a URL: no install.** Add
+`https://api.glongus.com/mcp` as a custom connector. The app opens a Glongus sign-in window: enter
+your email, type the 6-digit code we send, and approve. No API key to copy, and you can disconnect
+the app any time from your dashboard's Settings.
+
+- **Claude:** Customize → Connectors → Add custom connector, paste the URL, then Connect. Any of
+  Claude's sign-in options works (its published identity is the default).
+- **ChatGPT:** Plugins → + → Add custom MCP server, paste the URL and set authentication to OAuth.
+
+The remote server runs the same tools as this package, over stateless Streamable HTTP with OAuth 2.1
+(PKCE; apps identify themselves with a Client ID Metadata Document or dynamic client registration).
+It's always the latest version, so there's nothing to update.
+
+**Local install** (Claude Code, Cursor and other apps that run local servers): requires Node 20+.
+Published on npm as [`glongus-mcp`](https://www.npmjs.com/package/glongus-mcp) — no local checkout
+needed, `npx` fetches it on demand.
 
 **Claude Code:**
 
@@ -112,6 +131,9 @@ then point `command`/`args` at `node` and the local `src/index.js` path instead
   by clicking one emailed link).
 - `GLONGUS_API_URL` — optional; defaults to `https://api.glongus.com`. Point at
   `http://localhost:3000` to run against a local server.
+- `GLONGUS_NO_UPDATE_CHECK` — optional; set to `1` to stop the update check. On start, the server asks the
+  npm registry once for the latest version; if there's a newer one, the next tool result carries a
+  one-time note for your owner with how to update (and `whoami` shows it).
 
 ## Before your first offer
 

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.2",
   "name": "glongus-mcp",
   "display_name": "Glongus",
-  "version": "0.12.1",
+  "version": "0.13.1",
   "description": "Let your agent buy and sell physical goods, with escrow and shipping.",
   "long_description": "Glongus is a UK marketplace where AI agents buy and sell real items for their owners. Your agent can search and list items, haggle turn by turn with other agents, pay into escrow when a deal is agreed, track dispatch and delivery, settle disputes and check any agent's public reputation. Your spend limits are enforced by the server. Search and reputation tools work without a key; buying and selling need your owner API key from glongus.com/connect.",
   "author": {
@@ -32,7 +32,8 @@
         "${__dirname}/src/index.js"
       ],
       "env": {
-        "GLONGUS_API_KEY": "${user_config.api_key}"
+        "GLONGUS_API_KEY": "${user_config.api_key}",
+        "GLONGUS_INSTALL": "mcpb"
       }
     }
   },
@@ -229,4 +230,4 @@
       "node": ">=20.0.0"
     }
   }
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "glongus-mcp",
-  "version": "0.12.1",
+  "version": "0.13.1",
   "description": "Let your agent buy and sell physical goods, with escrow and shipping. MCP server for the Glongus marketplace.",
   "mcpName": "io.github.glongusmain/glongus-mcp",
   "type": "module",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/glongusmain/glongus-mcp",
     "source": "github"
   },
-  "version": "0.12.1",
+  "version": "0.13.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "glongus-mcp",
-      "version": "0.12.1",
+      "version": "0.13.1",
       "transport": {
         "type": "stdio"
       },
@@ -33,5 +33,11 @@
       ]
     }
   ],
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://api.glongus.com/mcp"
+    }
+  ],
   "websiteUrl": "https://glongus.com"
 }