granttap-mcp 0.8.11 → 0.8.12

package/README.md

@@ -224,13 +224,8 @@ grok plugin install granttap --trust
 ```
 
 Install **GrantTap** from the Cursor plugin marketplace, then open
-**Cursor Settings → MCP → GrantTap → Authorize**. From a source checkout the
-same plugin can be linked locally:
-
-```bash
-mkdir -p "$HOME/.cursor/plugins/local"
-ln -sfn "$PWD/cursor-plugin" "$HOME/.cursor/plugins/local/granttap"
-```
+**Cursor Customize → MCPs → GrantTap → Authenticate**. Complete authorization
+and any one-time QR pairing on `https://granttap.com/connect`.
 
 Open GrantTap from the plugin page or ask `Show my GrantTap pairing QR.` Codex
 renders an interactive connection card with pairing status, a one-time QR,

package/apps/bridge/src/bin/setup.ts

@@ -91,7 +91,7 @@ async function main(): Promise<void> {
       ? codexHook.status === "manual" || httpService?.status === "manual"
         ? "Needs attention" : !paired ? "Needs connection" : "Authorize in Codex; review hooks"
       : "Not installed"}`,
-    `Cursor              ${before.cursor.installed ? `Beta · ${cursorReady ? "Authorize in Cursor" : "Needs repair"}` : "Not installed"}`,
+    `Cursor              ${before.cursor.installed ? `Beta · ${cursorReady ? "Authenticate in Cursor" : "Needs repair"}` : "Not installed"}`,
     `Grok Build          ${installed.has("grok")
       ? httpService?.status === "manual" ? "Needs attention" : "Authorize in Grok Build"
       : "Not installed"}`,
@@ -102,9 +102,9 @@ async function main(): Promise<void> {
     paired && installed.has("codex")
       ? `Next: authorize GrantTap in Codex, then ${CODEX_TRUST_INSTRUCTION}`
       : paired && before.cursor.installed
-        ? "Next: open Cursor Settings → MCP → GrantTap → Authorize."
+        ? "Next: open Cursor Customize → MCPs → GrantTap → Authenticate."
         : !paired
-          ? "Next: run granttap connect."
+          ? "Next: authenticate GrantTap in your coding app; granttap.com/connect will show the pairing QR."
           : engine
             ? "Governance is live. Restart the helper to pick it up: launchctl kickstart -k gui/$(id -u)/com.granttap.monitor"
             : "Governance stays off until an engine is found. Point at one with: granttap setup --engine <path>",

package/apps/mcp/src/bin/authorize.ts

@@ -71,7 +71,7 @@ async function authorize(): Promise<void> {
         `[granttap-mcp] Cursor · Configured — ${cursor.detail}`,
         `[granttap-mcp] Persistent local OAuth is healthy at ${mcpUrl}`,
         `[granttap-mcp] LaunchAgent: ${service.status} (${service.detail})`,
-        "[granttap-mcp] Open Cursor Settings → MCP → GrantTap → Authorize.",
+        "[granttap-mcp] Open Cursor Customize → MCPs → GrantTap → Authenticate. The browser continues at granttap.com/connect.",
         "[granttap-mcp] If this Mac is not paired, granttap.com/connect shows a QR and manual token.",
         "",
       ].join("\n"),

package/apps/mcp/src/bin/serve.ts

@@ -15,9 +15,9 @@ async function serve(): Promise<void> {
     process.stderr.write(
       [
         `[granttap-mcp] HTTP MCP + OAuth listening on ${started.mcpUrl}`,
-        "[granttap-mcp] Cursor Settings → Authorize: set ~/.cursor/mcp.json entry to:",
+        "[granttap-mcp] Cursor authentication: set ~/.cursor/mcp.json entry to:",
         `  "granttap": { "url": "${started.mcpUrl}" }`,
-        "[granttap-mcp] Then open Cursor Settings → MCP → GrantTap → Authorize.",
+        "[granttap-mcp] Then open Cursor Customize → MCPs → GrantTap → Authenticate and continue at granttap.com/connect.",
         "",
       ].join("\n"),
     );

package/apps/mcp/src/connection-center/widget.html

@@ -37,7 +37,7 @@ details{border-top:1px solid #8884;padding-top:14px}summary{cursor:pointer;font-
     <h3>Provider readiness</h3><ul id="providers"></ul>
     <p>No GrantTap account or password is required. Pair using GrantTap on iPhone → Settings → Connections.
     Provider sign-in is separate.</p>
-    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.11</code> and <code>granttap setup</code> locally.
+    <p>Missing hooks or background sync? Run <code>npm install -g granttap-mcp@0.8.12</code> and <code>granttap setup</code> locally.
     A saved pairing alone does not prove your phone or the background helper is online.</p>
     <p><a href="https://granttap.com" target="_blank" rel="noopener noreferrer">Website</a> ·
     <a href="https://granttap.com/privacy" target="_blank" rel="noopener noreferrer">Privacy</a> ·

package/apps/mcp/src/cursor-config.ts

@@ -97,7 +97,7 @@ export function inspectCursorHttpConfig(
   }
   const config = parseConfig(path);
   if (!config) {
-    return { status: "action_required", detail: "Cursor mcp.json is invalid JSON; fix it before Authorize." };
+    return { status: "action_required", detail: "Cursor mcp.json is invalid JSON; fix it before authentication." };
   }
   const servers = config.mcpServers;
   if (servers == null) {
@@ -108,7 +108,7 @@ export function inspectCursorHttpConfig(
   }
   const entry = (servers as Record<string, unknown>).granttap;
   if (isHttpEntry(entry, expectedUrl)) {
-    return { status: "action_required", detail: "Endpoint configured; keep local OAuth running and Authorize in Cursor." };
+    return { status: "action_required", detail: "Endpoint configured; keep local OAuth running and complete authentication in Cursor." };
   }
   return entry == null
     ? { status: "not_configured", detail: "Run granttap setup to add Cursor." }

package/cursor-plugin/.cursor-plugin/marketplace.json

@@ -5,14 +5,14 @@
     "email": "support@granttap.com"
   },
   "metadata": {
-    "description": "GrantTap for Cursor — local HTTP MCP authorization and exactly correlated phone approvals",
-    "version": "0.1.1"
+    "description": "GrantTap for Cursor — authorize on granttap.com/connect and approve local tasks from your phone",
+    "version": "0.1.5"
   },
   "plugins": [
     {
       "name": "granttap",
       "source": "./",
-      "description": "Pair Cursor with GrantTap through loopback OAuth and keep each approval in its originating chat"
+      "description": "Authorize Cursor on granttap.com/connect, pair by QR, and keep each approval in its originating chat"
     }
   ]
 }

package/cursor-plugin/.cursor-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "name": "granttap",
   "displayName": "GrantTap",
-  "version": "0.1.1",
-  "description": "GrantTap for Cursor: loopback HTTP MCP authorization, phone pairing, and exactly correlated dual-channel approvals. Start with granttap authorize.",
+  "version": "0.1.5",
+  "description": "Connect Cursor to GrantTap through granttap.com/connect, pair your phone with a one-time QR, and keep approvals in the originating chat.",
   "author": {
     "name": "GrantTap",
     "email": "support@granttap.com",

package/cursor-plugin/README.md

@@ -1,18 +1,17 @@
 # GrantTap Cursor plugin
 
 GrantTap connects Cursor to the GrantTap phone app through a loopback-only HTTP
-MCP server. Cursor can show its native **Authorize** action, while GrantTap keeps
+MCP server. Cursor can show its native **Authenticate** action, while GrantTap keeps
 each phone response tied to the exact originating chat and prompt.
 
 ## Connect Cursor
 
-Install the supported CLI, then run the onboarding commands in this order:
+Install the supported CLI and the GrantTap plugin from Cursor's marketplace,
+then run:
 
 ```bash
 npm install -g granttap-mcp
 granttap setup
-granttap connect
-granttap setup
 granttap status
 ```
 
@@ -20,20 +19,17 @@ The commands have separate jobs:
 
 1. `granttap setup` detects Cursor, installs and verifies the persistent loopback OAuth/MCP
    service, then writes only GrantTap's entry in `~/.cursor/mcp.json`.
-2. `granttap connect` displays a one-time QR and a short manual code for pairing
-   the iPhone or iPad app. If the website already completed pairing,
-   this command is not needed again.
-3. `granttap setup` installs the Cursor, Claude Code, and Codex policy hooks and
-   the background task-sync helper. OAuth remains a separate authorization.
-4. `granttap status` performs a read-only readiness check.
-
-After `granttap setup`, open **Cursor Settings → MCP → GrantTap** and choose
-**Authorize**. The browser opens granttap.com/connect to authorize Cursor.
+2. `granttap setup` also installs the supported policy hooks and background
+   task-sync helper. OAuth remains a separate authorization.
+3. `granttap status` performs a read-only readiness check.
+
+After `granttap setup`, open **Cursor Customize → MCPs → GrantTap** and choose
+**Authenticate**. The browser opens granttap.com/connect to authorize Cursor.
 If the Mac is not paired, the website shows a one-time QR and manual-code
 fallback; a saved pairing is reused unless you explicitly confirm reconnect.
 
 The OAuth service listens only at `http://127.0.0.1:17342/mcp`. Cursor cannot
-show **Authorize** for a stdio (`command`/`args`) MCP entry, so do not replace the
+show **Authenticate** for a stdio (`command`/`args`) MCP entry, so do not replace the
 plugin's HTTP configuration with stdio.
 
 ## Install from the Cursor marketplace
@@ -43,15 +39,6 @@ The plugin adds the `/connect` command, a connect skill, and the
 exact-correlation rule; `granttap setup` still configures the MCP endpoint
 itself.
 
-From a source checkout, the same plugin can be linked locally:
-
-```bash
-mkdir -p "$HOME/.cursor/plugins/local"
-ln -sfn "$PWD/cursor-plugin" "$HOME/.cursor/plugins/local/granttap"
-```
-
-Run those commands from the repository root.
-
 ## Exact dual-channel behavior
 
 For an interactive question or approval, Cursor and the phone receive the same

package/cursor-plugin/commands/connect.md

@@ -7,13 +7,12 @@ end-to-end.
 
 1. Run `granttap setup` to detect Cursor and configure the persistent loopback HTTP
    MCP/OAuth service.
-2. Open **Cursor Settings → MCP → GrantTap → Authorize**.
-3. Run `granttap connect` if pairing is still required; surface its one-time QR
-   and manual code to the user.
-4. Run `granttap setup`, then verify the result with `granttap status`.
+2. Open **Cursor Customize → MCPs → GrantTap → Authenticate**. Complete
+   authorization and any one-time QR pairing on `https://granttap.com/connect`.
+3. Run `granttap status`, then verify the GrantTap MCP tools respond in Cursor.
 5. For a test question, send the same complete prompt to Cursor and GrantTap
    under one exact correlation. Accept only the first answer correlated to that
    prompt; never reuse a response from another chat or request.
 
 Do not replace the plugin's HTTP MCP entry with stdio: Cursor exposes
-**Authorize** only for HTTP/SSE MCP transports.
+**Authenticate** only for HTTP/SSE MCP transports.

package/cursor-plugin/skills/connect/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: granttap-connect
-description: Authorize Cursor and connect or reconnect GrantTap through loopback HTTP MCP. Use when the user asks to connect, pair, show a QR, reconnect, or repair Cursor Authorize.
+description: Authorize Cursor through granttap.com/connect, pair by QR, or reconnect GrantTap. Use when the user asks to connect, pair, show a QR, reconnect, or repair Cursor authentication.
 ---
 
 # GrantTap connect
@@ -9,7 +9,7 @@ Connect Cursor to the GrantTap phone app without weakening chat isolation.
 
 ## Workflow
 
-### 1. Configure Cursor Authorize
+### 1. Configure Cursor authentication
 
 Run:
 
@@ -19,7 +19,8 @@ granttap setup
 
 This installs and verifies the persistent loopback OAuth/MCP service before it
 changes GrantTap's entry in `~/.cursor/mcp.json`. Then direct the user to
-**Cursor Settings → MCP → GrantTap → Authorize**.
+**Cursor Customize → MCPs → GrantTap → Authenticate**. Cursor opens
+`https://granttap.com/connect` for authorization.
 
 The plugin endpoint must remain HTTP:
 
@@ -35,19 +36,15 @@ The plugin endpoint must remain HTTP:
 ```
 
 Do not replace it with a stdio `command`/`args` entry; Cursor does not expose
-its native **Authorize** action for stdio MCP servers.
+its native **Authenticate** action for stdio MCP servers.
 
-### 2. Pair the phone
+### 2. Pair the phone on the website
 
-If the Mac is not already paired, run:
-
-```bash
-granttap connect
-```
-
-Show the resulting one-time QR in chat. Preserve the short manual code as a
-fallback when the camera or QR rendering is unavailable. When Authorize starts
-first, `granttap.com/connect` offers the same pairing choices.
+If this computer has no pairing, `granttap.com/connect` shows a one-time QR and
+manual-code fallback. If it is already paired, the website reuses that pairing
+without replacing its keys. A new QR for another phone requires the user's
+explicit reconnect confirmation on the website. Do not present localhost as
+the user-facing settings page.
 
 ### 3. Install policy hooks
 
@@ -71,8 +68,8 @@ granttap status
 Confirm the loopback HTTP service and exact Cursor MCP entry are healthy,
 pairing is present, and required hooks are ready. `granttap status` cannot prove
 that Cursor retained an OAuth grant, so also confirm the MCP tools respond after
-**Authorize**. If Cursor loaded the MCP configuration beforehand, reload the
-Cursor window and retry **Authorize**.
+**Authenticate**. If Cursor loaded the MCP configuration beforehand, reload the
+Cursor window and retry **Authenticate**.
 
 For any interactive test, send the same complete prompt to Cursor and GrantTap
 under one exact correlation. The first answer carrying that exact correlation
@@ -86,4 +83,5 @@ correlation.
 - Run `granttap cursor repair` if `granttap status` reports an unhealthy OAuth
   service.
 - Re-run `granttap setup` if the policy hooks or background helper are missing.
-- Re-run `granttap connect` only when pairing is absent or must be replaced.
+- If the website cannot reach the local helper, check Chrome's local-network
+  permission for `granttap.com` and the background helper with `granttap status`.

package/docs/cursor-authorize.md

@@ -8,8 +8,8 @@ granttap setup
 
 When Cursor is installed, setup preserves unrelated MCP entries, installs the
 GrantTap shell and MCP policy hooks, configures the loopback HTTP MCP endpoint,
-and installs its persistent per-user service. Then open **Cursor Settings → MCP
-→ GrantTap → Authorize** to complete authorization on granttap.com.
+and installs its persistent per-user service. Then open **Cursor Customize →
+MCPs → GrantTap → Authenticate** to complete authorization on granttap.com/connect.
 
 The service binds only to loopback. Its OAuth token does not replace GrantTap's
 end-to-end encrypted computer pairing.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granttap-mcp",
-  "version": "0.8.11",
+  "version": "0.8.12",
   "description": "Personal live control center runtime for local coding agents on iPhone and Apple Watch.",
   "type": "module",
   "bin": {