jujugrowth-mcp 1.0.2 → 1.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jujugrowth-mcp",
-  "version": "1.0.2",
+  "version": "1.0.5",
   "description": "MCP server connecting your AI coding assistant (Claude, Cursor, Codex) to jujugrowth — pull recommendations and apply them in your repo.",
   "type": "module",
   "bin": {

package/server.mjs

@@ -17,6 +17,7 @@
 
 const API = (process.env.JUJUGROWTH_API ?? "https://jujugrowth.com").replace(/\/+$/, "");
 const TOKEN = process.env.JUJUGROWTH_TOKEN ?? "";
+// Published automatically by CI (.github/workflows/publish-mcp.yml) on version bump.
 
 async function call(method, path, body) {
   const res = await fetch(`${API}/api/mcp${path}`, {
@@ -32,13 +33,37 @@ async function call(method, path, body) {
   return text ? JSON.parse(text) : {};
 }
 
+// This server is bound to ONE token → usually ONE site. It announces that
+// site (serverInfo + a banner on every result) so a dev-AI with several
+// jujugrowth servers on one machine can never act on the wrong site.
+let SITE_LABEL = null; // e.g. "jujublocks.com"
+async function loadIdentity() {
+  try {
+    const me = await call("GET", "/whoami");
+    SITE_LABEL = me.scoped ? me.business : null; // null = multi-site (unscoped) token
+  } catch {
+    SITE_LABEL = null;
+  }
+}
+const siteBanner = () =>
+  SITE_LABEL
+    ? `⚠️ This jujugrowth server is bound to the site "${SITE_LABEL}". Only act on this site. If the user meant a different site, stop and use that site's jujugrowth server.\n\n`
+    : "";
+
 const TOOLS = [
   {
     name: "list_recommendations",
     description:
-      "List open jujugrowth recommendations across the businesses you can access. Returns id, tenantId, title, action_type, risk_class.",
-    inputSchema: { type: "object", properties: {}, additionalProperties: false },
-    run: async () => call("GET", "/recommendations"),
+      "List open jujugrowth recommendations. Pass `tenantId` to target a specific site. If you don't and more than one site is connected, the result is {needsSite:true, message, businesses[]} — in that case ASK THE USER which site (show the names), then call again with that tenantId. Never pick a site for them.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        tenantId: { type: "string", description: "the site to list (optional; required when more than one site is connected)" },
+      },
+      additionalProperties: false,
+    },
+    run: async (a) =>
+      call("GET", `/recommendations${a.tenantId ? `?tenantId=${encodeURIComponent(a.tenantId)}` : ""}`),
   },
   {
     name: "get_recommendation",
@@ -102,13 +127,17 @@ function send(msg) {
 async function handle(msg) {
   const { id, method, params } = msg;
   if (method === "initialize") {
+    await loadIdentity(); // learn which site this token is bound to
     return send({
       jsonrpc: "2.0",
       id,
       result: {
         protocolVersion: "2024-11-05",
         capabilities: { tools: {} },
-        serverInfo: { name: "jujugrowth", version: "1.0.0" },
+        serverInfo: {
+          name: SITE_LABEL ? `jujugrowth (${SITE_LABEL})` : "jujugrowth",
+          version: "1.0.0",
+        },
       },
     });
   }
@@ -129,7 +158,9 @@ async function handle(msg) {
       return send({
         jsonrpc: "2.0",
         id,
-        result: { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] },
+        result: {
+          content: [{ type: "text", text: siteBanner() + JSON.stringify(result, null, 2) }],
+        },
       });
     } catch (err) {
       return send({