katto-mcp 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -0,0 +1,41 @@
+# Changelog
+
+All notable changes to `katto-mcp` are documented here. This project follows
+[Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [0.6.1] - 2026-10-19
+### Changed
+- Releases are now published from GitHub Actions with npm provenance
+  (sigstore build attestation linking each tarball to its source commit and
+  workflow run). Verify with `npm audit signatures`.
+- The public repository now carries the exact source published to npm
+  (it had fallen behind at 0.5.9 / 16 tools while npm shipped 0.6.0).
+
+## [0.5.2 – 0.6.0] - 2026-10-13
+### Added
+- Grew from 15 to 29 tools (clip pool, subtitle translation, retitling,
+  publishing and scheduled posts, connected accounts, clip adjustments).
+  The README lists every tool; `katto_*` names are stable.
+
+## [0.5.1] - 2026-08-21
+### Added
+- 15 tools covering the full clipping workflow: create/list/get jobs, get clips,
+  transcript, usage, account, cancel, list sources, list clip lengths, rerender,
+  dub, get rerender, brand kit, webhook secret.
+- Hosted connector documented: `https://mcp.katto.tech/mcp` (Streamable HTTP,
+  OAuth 2.1 + Dynamic Client Registration) alongside the local `npx` transport.
+
+### Changed
+- Enriched README with per-tool descriptions and client setup (Claude, Cursor,
+  ChatGPT and any MCP-compatible client).
+
+## [0.3.1] - 2026-08-21
+### Added
+- Expanded from 6 to 8 tools (cancel job, get clips, account introspection).
+
+## [0.2.1] - 2026-08-20
+### Added
+- Initial public release: create clip jobs and poll results from any MCP client.
+- Published to npm and the official MCP Registry.

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Katto (https://katto.tech)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Katto (https://katto.tech)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/SECURITY.md

@@ -0,0 +1,40 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+If you find a security issue in `katto-mcp` or the Katto API/MCP endpoints,
+please report it privately: **security@katto.tech** (or via
+https://katto.tech/contact). We aim to acknowledge within 48 hours.
+
+Please do not open a public issue for security reports.
+
+## How this client handles credentials
+
+- `katto-mcp` reads your API key from the `KATTO_API_KEY` environment variable
+  and sends it only to the Katto API over HTTPS. The key is never logged.
+- Prefer a **read-only scoped key** for agents that only need to poll jobs and
+  read clips. Create and scope keys at https://katto.tech/dashboard/api-keys.
+- For zero-install use, the hosted connector at `https://mcp.katto.tech/mcp`
+  uses OAuth 2.1 + Dynamic Client Registration, so no key is stored on disk.
+
+## Supported versions
+
+The latest published version on npm receives fixes. Older versions are not
+maintained.
+
+## Verifying a release
+
+Every version from 0.6.1 on is built and published by the
+[`publish.yml`](.github/workflows/publish.yml) workflow of this repository,
+with an [npm provenance](https://docs.npmjs.com/generating-provenance-statements)
+attestation signed through Sigstore. The attestation binds the tarball to the
+exact commit and workflow run that produced it.
+
+```bash
+npm view katto-mcp dist.attestations   # provenance URL for the latest version
+mkdir /tmp/k && cd /tmp/k && npm init -y >/dev/null && npm i katto-mcp
+npm audit signatures                    # checks registry signatures + provenance
+```
+
+The package has no install or post-install scripts and a single runtime
+dependency (`@modelcontextprotocol/sdk`).

package/index.mjs

@@ -615,7 +615,7 @@ function hookBody(args) {
   return b;
 }
 
-const server = new Server({ name: "katto", version: "0.6.0" }, { capabilities: { tools: {} }, instructions: SERVER_INSTRUCTIONS });
+const server = new Server({ name: "katto", version: "0.6.1" }, { capabilities: { tools: {} }, instructions: SERVER_INSTRUCTIONS });
 
 server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS_LISTED }));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "katto-mcp",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "mcpName": "io.github.miracleweasel/katto-mcp",
   "description": "AI video clipping MCP server: turn long videos, podcasts and Twitch VODs into scored, captioned 9:16 shorts from Claude, Cursor, ChatGPT and any MCP client.",
   "type": "module",
@@ -8,6 +8,7 @@
     "katto-mcp": "index.mjs"
   },
   "scripts": {
+    "test": "node --test test/smoke.test.mjs",
     "check-drift": "node check-tool-drift.mjs"
   },
   "files": [
@@ -15,7 +16,9 @@
     "README.md",
     "LICENSE",
     "SKILL.md",
-    "QUICKSTART.md"
+    "QUICKSTART.md",
+    "SECURITY.md",
+    "CHANGELOG.md"
   ],
   "engines": {
     "node": ">=18"
@@ -47,6 +50,11 @@
   },
   "author": "Katto (https://katto.tech)",
   "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true,
+    "registry": "https://registry.npmjs.org/"
+  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0"
   }