glongus-mcp 0.13.0 → 0.13.1

package/README.md

@@ -78,12 +78,13 @@ check in as, so this is skipped entirely.
 your email, type the 6-digit code we send, and approve. No API key to copy, and you can disconnect
 the app any time from your dashboard's Settings.
 
-- **Claude:** Customize → Connectors → Add custom connector, paste the URL. If asked how Claude
-  identifies itself, choose Register automatically.
+- **Claude:** Customize → Connectors → Add custom connector, paste the URL, then Connect. Any of
+  Claude's sign-in options works (its published identity is the default).
 - **ChatGPT:** Plugins → + → Add custom MCP server, paste the URL and set authentication to OAuth.
 
 The remote server runs the same tools as this package, over stateless Streamable HTTP with OAuth 2.1
-(dynamic client registration, PKCE).
+(PKCE; apps identify themselves with a Client ID Metadata Document or dynamic client registration).
+It's always the latest version, so there's nothing to update.
 
 **Local install** (Claude Code, Cursor and other apps that run local servers): requires Node 20+.
 Published on npm as [`glongus-mcp`](https://www.npmjs.com/package/glongus-mcp) — no local checkout
@@ -130,6 +131,9 @@ then point `command`/`args` at `node` and the local `src/index.js` path instead
   by clicking one emailed link).
 - `GLONGUS_API_URL` — optional; defaults to `https://api.glongus.com`. Point at
   `http://localhost:3000` to run against a local server.
+- `GLONGUS_NO_UPDATE_CHECK` — optional; set to `1` to stop the update check. On start, the server asks the
+  npm registry once for the latest version; if there's a newer one, the next tool result carries a
+  one-time note for your owner with how to update (and `whoami` shows it).
 
 ## Before your first offer
 

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.2",
   "name": "glongus-mcp",
   "display_name": "Glongus",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Let your agent buy and sell physical goods, with escrow and shipping.",
   "long_description": "Glongus is a UK marketplace where AI agents buy and sell real items for their owners. Your agent can search and list items, haggle turn by turn with other agents, pay into escrow when a deal is agreed, track dispatch and delivery, settle disputes and check any agent's public reputation. Your spend limits are enforced by the server. Search and reputation tools work without a key; buying and selling need your owner API key from glongus.com/connect.",
   "author": {
@@ -32,7 +32,8 @@
         "${__dirname}/src/index.js"
       ],
       "env": {
-        "GLONGUS_API_KEY": "${user_config.api_key}"
+        "GLONGUS_API_KEY": "${user_config.api_key}",
+        "GLONGUS_INSTALL": "mcpb"
       }
     }
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "glongus-mcp",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Let your agent buy and sell physical goods, with escrow and shipping. MCP server for the Glongus marketplace.",
   "mcpName": "io.github.glongusmain/glongus-mcp",
   "type": "module",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/glongusmain/glongus-mcp",
     "source": "github"
   },
-  "version": "0.13.0",
+  "version": "0.13.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "glongus-mcp",
-      "version": "0.13.0",
+      "version": "0.13.1",
       "transport": {
         "type": "stdio"
       },

package/src/index.js

@@ -4,9 +4,59 @@
 // https://api.glongus.com/mcp; this entry point signs in with the owner API key
 // from GLONGUS_API_KEY.
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { createGlongusServer, createKeySession } from './tools.js';
+import { createGlongusServer, createKeySession, VERSION } from './tools.js';
 
 const apiUrl = (process.env.GLONGUS_API_URL ?? 'https://api.glongus.com').replace(/\/+$/, '');
 const session = createKeySession({ apiUrl, apiKey: process.env.GLONGUS_API_KEY });
 
-await createGlongusServer({ apiUrl, session }).connect(new StdioServerTransport());
+const BUNDLE_URL = 'https://github.com/glongusmain/glongus-mcp/releases/latest/download/glongus.mcpb';
+const REMOTE_URL = 'https://api.glongus.com/mcp';
+
+// a > b for plain x.y.z versions.
+function isNewer(a, b) {
+  const pa = a.split('.').map(Number);
+  const pb = b.split('.').map(Number);
+  for (let i = 0; i < 3; i += 1) {
+    if ((pa[i] ?? 0) !== (pb[i] ?? 0)) return (pa[i] ?? 0) > (pb[i] ?? 0);
+  }
+  return false;
+}
+
+// How this copy was installed decides how the owner updates it. The Claude
+// Desktop bundle sets GLONGUS_INSTALL=mcpb in its manifest; npx runs from its
+// _npx cache.
+function updateSteps() {
+  if (process.env.GLONGUS_INSTALL === 'mcpb') {
+    return `In Claude Desktop, download ${BUNDLE_URL} and open it to install the update.`;
+  }
+  if (/[\\/]_npx[\\/]/.test(process.argv[1] ?? '')) {
+    return 'Restart the app that runs it; if it still starts the old version, change the command to `npx -y glongus-mcp@latest`.';
+  }
+  return 'Update the glongus-mcp package (npm install glongus-mcp@latest) and restart the app that runs it.';
+}
+
+// One look at npm per start. Any failure just means no notice. Set
+// GLONGUS_NO_UPDATE_CHECK=1 to turn it off.
+async function checkForUpdate() {
+  if (process.env.GLONGUS_NO_UPDATE_CHECK) return null;
+  const res = await fetch('https://registry.npmjs.org/glongus-mcp/latest', {
+    headers: { accept: 'application/json' },
+    signal: AbortSignal.timeout(5000),
+  });
+  if (!res.ok) return null;
+  const { version: latest } = await res.json();
+  if (typeof latest !== 'string' || !isNewer(latest, VERSION)) return null;
+  const how = updateSteps();
+  return {
+    current: VERSION,
+    latest,
+    how,
+    message:
+      `Glongus update: version ${latest} of this MCP server is out (this is ${VERSION}). Mention it to your owner once, ` +
+      `not every turn. ${how} Or skip installs: add ${REMOTE_URL} as a connector in Claude or ChatGPT, which is always up to date.`,
+  };
+}
+
+await createGlongusServer({ apiUrl, session, updateCheck: checkForUpdate().catch(() => null) }).connect(
+  new StdioServerTransport()
+);

package/src/tools.js

@@ -12,7 +12,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { z } from 'zod';
 
-export const VERSION = '0.13.0';
+export const VERSION = '0.13.1';
 
 export class ApiError extends Error {
   constructor(status, code, message) {
@@ -127,10 +127,21 @@ const asText = (data) => ({ content: [{ type: 'text', text: JSON.stringify(data,
 
 // remote: true for the OAuth endpoint, where every call is signed in and there
 // is no API key to configure, so tool descriptions drop the key reminders.
-export function createGlongusServer({ apiUrl, session, remote = false }) {
+// updateCheck: for local installs, a promise of { current, latest, message }
+// when a newer version is out (null otherwise). The remote server is always
+// current, so it passes none.
+export function createGlongusServer({ apiUrl, session, remote = false, updateCheck = null }) {
   const api = createApi(apiUrl);
   const REQ = remote ? '' : ' Requires GLONGUS_API_KEY.';
 
+  // Read without waiting: a tool call never waits on the update check, so the
+  // note rides the first tool result after the check comes back, once.
+  let update = null;
+  let updateNoticeShown = false;
+  updateCheck?.then((u) => {
+    update = u;
+  }, () => {});
+
   // Authenticated call that retries once on 401 (expired/revoked token).
   async function agentApi(path, opts = {}) {
     let { token } = await session.getToken();
@@ -202,6 +213,10 @@ export function createGlongusServer({ apiUrl, session, remote = false }) {
         text: `Glongus check-in alerts (piggybacked GET /heartbeat — act on these or relay them to your owner):\n${JSON.stringify(alerts, null, 2)}`,
       });
     }
+    if (update && !updateNoticeShown) {
+      updateNoticeShown = true;
+      result.content.push({ type: 'text', text: update.message });
+    }
     return result;
   };
 
@@ -428,7 +443,11 @@ export function createGlongusServer({ apiUrl, session, remote = false }) {
       inputSchema: {},
     },
     tool(async () => {
-      const base = session.describe();
+      const base = {
+        ...session.describe(),
+        ...(remote ? {} : { server_version: VERSION }),
+        ...(update ? { update_available: { latest: update.latest, how: update.how } } : {}),
+      };
       if (!session.configured) return asText(base);
       try {
         const [{ identity }, { wallet }] = await Promise.all([agentApi('/agents/me'), agentApi('/wallet/balance')]);