jujugrowth-mcp 1.0.2 → 1.0.6

package/README.md

@@ -39,9 +39,20 @@ claude mcp add jujugrowth --scope user \
 The jujugrowth Settings → Developer panel generates the token and shows these
 commands pre-filled.
 
-3. Restart the client. You'll have three tools:
-   - `list_recommendations` — open recommendations across your businesses
+3. Restart the client. **First use:** your AI will ask to approve the jujugrowth
+   tools the first time it calls them — approve them. (In Claude Code, if it's in
+   "don't ask"/deny mode it silently refuses — toggle the permission mode or run
+   `/allowed-tools`, then approve once.)
+
+   You'll have these tools:
+   - `list_recommendations` — open recommendations (one site if the token is scoped)
    - `get_recommendation` — the full brief for one (implement it in your repo)
-   - `mark_recommendation_handled` — mark it done after you've shipped it
+   - `mark_recommendation_handled` — mark it done (with a note of what you changed)
+   - `request_site_advice` — Pro: trigger a fresh website analysis
+   - `request_campaign_brief` — Pro: trigger a campaign brief
+
+A token can be scoped to one business; the server then announces itself as
+`jujugrowth (yoursite.com)` and only ever touches that site. Generate scoped
+tokens in jujugrowth → Settings → Developer (one per business/repo).
 
 Requires Node ≥ 22. Optional env `JUJUGROWTH_API` (defaults to https://jujugrowth.com).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jujugrowth-mcp",
-  "version": "1.0.2",
+  "version": "1.0.6",
   "description": "MCP server connecting your AI coding assistant (Claude, Cursor, Codex) to jujugrowth — pull recommendations and apply them in your repo.",
   "type": "module",
   "bin": {

package/server.mjs

@@ -17,6 +17,7 @@
 
 const API = (process.env.JUJUGROWTH_API ?? "https://jujugrowth.com").replace(/\/+$/, "");
 const TOKEN = process.env.JUJUGROWTH_TOKEN ?? "";
+// Published automatically by CI (.github/workflows/publish-mcp.yml) on version bump.
 
 async function call(method, path, body) {
   const res = await fetch(`${API}/api/mcp${path}`, {
@@ -32,13 +33,37 @@ async function call(method, path, body) {
   return text ? JSON.parse(text) : {};
 }
 
+// This server is bound to ONE token → usually ONE site. It announces that
+// site (serverInfo + a banner on every result) so a dev-AI with several
+// jujugrowth servers on one machine can never act on the wrong site.
+let SITE_LABEL = null; // e.g. "jujublocks.com"
+async function loadIdentity() {
+  try {
+    const me = await call("GET", "/whoami");
+    SITE_LABEL = me.scoped ? me.business : null; // null = multi-site (unscoped) token
+  } catch {
+    SITE_LABEL = null;
+  }
+}
+const siteBanner = () =>
+  SITE_LABEL
+    ? `⚠️ This jujugrowth server is bound to the site "${SITE_LABEL}". Only act on this site. If the user meant a different site, stop and use that site's jujugrowth server.\n\n`
+    : "";
+
 const TOOLS = [
   {
     name: "list_recommendations",
     description:
-      "List open jujugrowth recommendations across the businesses you can access. Returns id, tenantId, title, action_type, risk_class.",
-    inputSchema: { type: "object", properties: {}, additionalProperties: false },
-    run: async () => call("GET", "/recommendations"),
+      "List open jujugrowth recommendations. Pass `tenantId` to target a specific site. If you don't and more than one site is connected, the result is {needsSite:true, message, businesses[]} — in that case ASK THE USER which site (show the names), then call again with that tenantId. Never pick a site for them.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        tenantId: { type: "string", description: "the site to list (optional; required when more than one site is connected)" },
+      },
+      additionalProperties: false,
+    },
+    run: async (a) =>
+      call("GET", `/recommendations${a.tenantId ? `?tenantId=${encodeURIComponent(a.tenantId)}` : ""}`),
   },
   {
     name: "get_recommendation",
@@ -102,13 +127,17 @@ function send(msg) {
 async function handle(msg) {
   const { id, method, params } = msg;
   if (method === "initialize") {
+    await loadIdentity(); // learn which site this token is bound to
     return send({
       jsonrpc: "2.0",
       id,
       result: {
         protocolVersion: "2024-11-05",
         capabilities: { tools: {} },
-        serverInfo: { name: "jujugrowth", version: "1.0.0" },
+        serverInfo: {
+          name: SITE_LABEL ? `jujugrowth (${SITE_LABEL})` : "jujugrowth",
+          version: "1.0.0",
+        },
       },
     });
   }
@@ -129,7 +158,9 @@ async function handle(msg) {
       return send({
         jsonrpc: "2.0",
         id,
-        result: { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] },
+        result: {
+          content: [{ type: "text", text: siteBanner() + JSON.stringify(result, null, 2) }],
+        },
       });
     } catch (err) {
       return send({