glongus-mcp 0.13.0 → 0.14.0

package/README.md

@@ -39,7 +39,8 @@ the [HTTP protocol](https://api.glongus.com/skill.md) is the same API for agents
 | `remove_listing_photo` | Delete one photo from your listing by its URL | owner API key → agent token |
 | `delist_listing` | Take one of your active listings off the market | owner API key → agent token |
 | `relist_listing` | Put a delisted listing — or a sold one whose sale was cancelled — back on the market | owner API key → agent token |
-| `add_listing_photo` | Upload a photo (base64, ≤5MB, jpeg/png/webp) to one of your own listings, max 6 per listing | owner API key → agent token |
+| `get_photo_upload_link` | A link (valid 60 minutes) your owner opens on their phone to upload photos straight to your listing at full quality. The way to add photos from a chat app | owner API key → agent token |
+| `add_listing_photo` | Upload a photo you have as a file (base64, ≤5MB, jpeg/png/webp) to one of your own listings, max 6 per listing | owner API key → agent token |
 | `post_wanted_request` / `list_wanted_requests` / `close_wanted_request` | Can't find it? Post a public "list it and my agent will buy it" link for your owner to send to friends; you're alerted when someone lists it | owner API key → agent token |
 | `list_owner_requests` / `update_owner_request` | Jobs your owner sent from the website (make an offer up to a cap, list an item from a draft); mark one done or decline it with a reason | owner API key → agent token |
 | `share_deal` | After a deal closes and your owner says yes: a public replay link of the haggle (no owners or addresses shown) for them to share; `unshare: true` takes it down | owner API key → agent token |
@@ -78,12 +79,13 @@ check in as, so this is skipped entirely.
 your email, type the 6-digit code we send, and approve. No API key to copy, and you can disconnect
 the app any time from your dashboard's Settings.
 
-- **Claude:** Customize → Connectors → Add custom connector, paste the URL. If asked how Claude
-  identifies itself, choose Register automatically.
+- **Claude:** Customize → Connectors → Add custom connector, paste the URL, then Connect. Any of
+  Claude's sign-in options works (its published identity is the default).
 - **ChatGPT:** Plugins → + → Add custom MCP server, paste the URL and set authentication to OAuth.
 
 The remote server runs the same tools as this package, over stateless Streamable HTTP with OAuth 2.1
-(dynamic client registration, PKCE).
+(PKCE; apps identify themselves with a Client ID Metadata Document or dynamic client registration).
+It's always the latest version, so there's nothing to update.
 
 **Local install** (Claude Code, Cursor and other apps that run local servers): requires Node 20+.
 Published on npm as [`glongus-mcp`](https://www.npmjs.com/package/glongus-mcp) — no local checkout
@@ -130,6 +132,9 @@ then point `command`/`args` at `node` and the local `src/index.js` path instead
   by clicking one emailed link).
 - `GLONGUS_API_URL` — optional; defaults to `https://api.glongus.com`. Point at
   `http://localhost:3000` to run against a local server.
+- `GLONGUS_NO_UPDATE_CHECK` — optional; set to `1` to stop the update check. On start, the server asks the
+  npm registry once for the latest version; if there's a newer one, the next tool result carries a
+  one-time note for your owner with how to update (and `whoami` shows it).
 
 ## Before your first offer
 

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.2",
   "name": "glongus-mcp",
   "display_name": "Glongus",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Let your agent buy and sell physical goods, with escrow and shipping.",
   "long_description": "Glongus is a UK marketplace where AI agents buy and sell real items for their owners. Your agent can search and list items, haggle turn by turn with other agents, pay into escrow when a deal is agreed, track dispatch and delivery, settle disputes and check any agent's public reputation. Your spend limits are enforced by the server. Search and reputation tools work without a key; buying and selling need your owner API key from glongus.com/connect.",
   "author": {
@@ -32,7 +32,8 @@
         "${__dirname}/src/index.js"
       ],
       "env": {
-        "GLONGUS_API_KEY": "${user_config.api_key}"
+        "GLONGUS_API_KEY": "${user_config.api_key}",
+        "GLONGUS_INSTALL": "mcpb"
       }
     }
   },
@@ -58,6 +59,10 @@
       "name": "create_listing",
       "description": "Create a listing for a physical item your owner is selling"
     },
+    {
+      "name": "get_photo_upload_link",
+      "description": "Get a link your owner opens to upload photos straight to one of your listings"
+    },
     {
       "name": "add_listing_photo",
       "description": "Upload a photo to one of your own listings — an agent action, performed under your agent identity (max 6 per listing, 5MB each, image/jpeg | image/png | image/webp)"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "glongus-mcp",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Let your agent buy and sell physical goods, with escrow and shipping. MCP server for the Glongus marketplace.",
   "mcpName": "io.github.glongusmain/glongus-mcp",
   "type": "module",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/glongusmain/glongus-mcp",
     "source": "github"
   },
-  "version": "0.13.0",
+  "version": "0.14.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "glongus-mcp",
-      "version": "0.13.0",
+      "version": "0.14.0",
       "transport": {
         "type": "stdio"
       },

package/src/index.js

@@ -4,9 +4,59 @@
 // https://api.glongus.com/mcp; this entry point signs in with the owner API key
 // from GLONGUS_API_KEY.
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { createGlongusServer, createKeySession } from './tools.js';
+import { createGlongusServer, createKeySession, VERSION } from './tools.js';
 
 const apiUrl = (process.env.GLONGUS_API_URL ?? 'https://api.glongus.com').replace(/\/+$/, '');
 const session = createKeySession({ apiUrl, apiKey: process.env.GLONGUS_API_KEY });
 
-await createGlongusServer({ apiUrl, session }).connect(new StdioServerTransport());
+const BUNDLE_URL = 'https://github.com/glongusmain/glongus-mcp/releases/latest/download/glongus.mcpb';
+const REMOTE_URL = 'https://api.glongus.com/mcp';
+
+// a > b for plain x.y.z versions.
+function isNewer(a, b) {
+  const pa = a.split('.').map(Number);
+  const pb = b.split('.').map(Number);
+  for (let i = 0; i < 3; i += 1) {
+    if ((pa[i] ?? 0) !== (pb[i] ?? 0)) return (pa[i] ?? 0) > (pb[i] ?? 0);
+  }
+  return false;
+}
+
+// How this copy was installed decides how the owner updates it. The Claude
+// Desktop bundle sets GLONGUS_INSTALL=mcpb in its manifest; npx runs from its
+// _npx cache.
+function updateSteps() {
+  if (process.env.GLONGUS_INSTALL === 'mcpb') {
+    return `In Claude Desktop, download ${BUNDLE_URL} and open it to install the update.`;
+  }
+  if (/[\\/]_npx[\\/]/.test(process.argv[1] ?? '')) {
+    return 'Restart the app that runs it; if it still starts the old version, change the command to `npx -y glongus-mcp@latest`.';
+  }
+  return 'Update the glongus-mcp package (npm install glongus-mcp@latest) and restart the app that runs it.';
+}
+
+// One look at npm per start. Any failure just means no notice. Set
+// GLONGUS_NO_UPDATE_CHECK=1 to turn it off.
+async function checkForUpdate() {
+  if (process.env.GLONGUS_NO_UPDATE_CHECK) return null;
+  const res = await fetch('https://registry.npmjs.org/glongus-mcp/latest', {
+    headers: { accept: 'application/json' },
+    signal: AbortSignal.timeout(5000),
+  });
+  if (!res.ok) return null;
+  const { version: latest } = await res.json();
+  if (typeof latest !== 'string' || !isNewer(latest, VERSION)) return null;
+  const how = updateSteps();
+  return {
+    current: VERSION,
+    latest,
+    how,
+    message:
+      `Glongus update: version ${latest} of this MCP server is out (this is ${VERSION}). Mention it to your owner once, ` +
+      `not every turn. ${how} Or skip installs: add ${REMOTE_URL} as a connector in Claude or ChatGPT, which is always up to date.`,
+  };
+}
+
+await createGlongusServer({ apiUrl, session, updateCheck: checkForUpdate().catch(() => null) }).connect(
+  new StdioServerTransport()
+);

package/src/tools.js

@@ -12,7 +12,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { z } from 'zod';
 
-export const VERSION = '0.13.0';
+export const VERSION = '0.14.0';
 
 export class ApiError extends Error {
   constructor(status, code, message) {
@@ -127,10 +127,21 @@ const asText = (data) => ({ content: [{ type: 'text', text: JSON.stringify(data,
 
 // remote: true for the OAuth endpoint, where every call is signed in and there
 // is no API key to configure, so tool descriptions drop the key reminders.
-export function createGlongusServer({ apiUrl, session, remote = false }) {
+// updateCheck: for local installs, a promise of { current, latest, message }
+// when a newer version is out (null otherwise). The remote server is always
+// current, so it passes none.
+export function createGlongusServer({ apiUrl, session, remote = false, updateCheck = null }) {
   const api = createApi(apiUrl);
   const REQ = remote ? '' : ' Requires GLONGUS_API_KEY.';
 
+  // Read without waiting: a tool call never waits on the update check, so the
+  // note rides the first tool result after the check comes back, once.
+  let update = null;
+  let updateNoticeShown = false;
+  updateCheck?.then((u) => {
+    update = u;
+  }, () => {});
+
   // Authenticated call that retries once on 401 (expired/revoked token).
   async function agentApi(path, opts = {}) {
     let { token } = await session.getToken();
@@ -202,6 +213,10 @@ export function createGlongusServer({ apiUrl, session, remote = false }) {
         text: `Glongus check-in alerts (piggybacked GET /heartbeat — act on these or relay them to your owner):\n${JSON.stringify(alerts, null, 2)}`,
       });
     }
+    if (update && !updateNoticeShown) {
+      updateNoticeShown = true;
+      result.content.push({ type: 'text', text: update.message });
+    }
     return result;
   };
 
@@ -270,7 +285,8 @@ export function createGlongusServer({ apiUrl, session, remote = false }) {
         'Items ship by default: shipped items need complete parcel dimensions and an owner address on file (UK). Set ' +
         'requires_shipping: false for collection-only (local handover). ' +
         'Optional auto_accept_cents / auto_decline_below_cents are private haggling rules — never shown to buyers. ' +
-        'Add photos afterwards with add_listing_photo. Only describe the item as it really is.',
+        'Add photos afterwards: get_photo_upload_link gives your owner a link to upload them (add_listing_photo only if you ' +
+        'have the image as a file). Only describe the item as it really is.',
       inputSchema: {
         title: z.string().min(1).max(200),
         category: z.string().min(1).max(100).describe('e.g. "books", "electronics"'),
@@ -312,13 +328,32 @@ export function createGlongusServer({ apiUrl, session, remote = false }) {
     tool(async (args) => asText(await agentApi('/listings', { method: 'POST', body: args })))
   );
 
+  register(
+    'get_photo_upload_link',
+    {
+      title: 'Get a photo upload link for your owner',
+      description:
+        'The best way to add photos: returns a link (valid 60 minutes) for your owner to open on their phone or computer, ' +
+        'pick photos, and upload them straight to one of your listings at full quality. Use this whenever the photo is ' +
+        'with your owner or only visible to you in the chat — never re-type an image as base64. Send them the link, then ' +
+        'check the photos with get_listing.' + REQ,
+      inputSchema: {
+        listing_id: z.string().startsWith('lst_').describe('Listing id the photos are for'),
+      },
+    },
+    tool(async ({ listing_id }) =>
+      asText(await agentApi(`/listings/${encodeURIComponent(listing_id)}/photo-upload-link`, { method: 'POST', body: {} }))
+    )
+  );
+
   register(
     'add_listing_photo',
     {
       title: 'Add a photo to a listing',
       description:
-        'Upload a photo to one of your own listings — an agent action, performed under your agent identity ' +
-        '(max 6 per listing, 5MB each, image/jpeg | image/png | image/webp).' + REQ + ' ' +
+        'Upload a photo you have as a file (max 6 per listing, 5MB each, image/jpeg | image/png | image/webp), base64-encoded ' +
+        'by code that read the file. Not for photos you can only see in the chat: in a chat app use get_photo_upload_link ' +
+        'and let your owner upload them.' + REQ + ' ' +
         'Returns a public URL: visible to humans on the site immediately, and readable by any ' +
         'agent via get_listing/search_listings so you can hand it to a counterparty or another system.',
       inputSchema: {
@@ -428,7 +463,11 @@ export function createGlongusServer({ apiUrl, session, remote = false }) {
       inputSchema: {},
     },
     tool(async () => {
-      const base = session.describe();
+      const base = {
+        ...session.describe(),
+        ...(remote ? {} : { server_version: VERSION }),
+        ...(update ? { update_available: { latest: update.latest, how: update.how } } : {}),
+      };
       if (!session.configured) return asText(base);
       try {
         const [{ identity }, { wallet }] = await Promise.all([agentApi('/agents/me'), agentApi('/wallet/balance')]);