kiku-agent 1.0.11 → 1.2.0

package/server/mcp/data/works.js

@@ -16,27 +16,40 @@ export const worksData = [
     featured: true, highlights: ["Reunion of popular pairing Ju Jingyi + Song Weilong", "Top-tier VFX and costumes by Youku"],
   },
   {
-    id: "wanhua-sin", titleEn: "Wanhua Sin", titleCn: "万花世界", year: 2026,
+    id: "wanhua-sin-upcoming", alias: "wanhua-sin", titleEn: "Wanhua Sin", titleCn: "万花世界", year: 2026,
     category: "fantasy-drama", role: "Lead Role", platform: "TBA",
-    synopsis: "Upcoming fantasy epic. Promo OST: 'Set Fire to the Silent World' (着火的沉默世界).",
+    synopsis: "Upcoming fantasy epic under Ju Jingyi Studio. Promo OST: 'Set Fire to the Silent World' (着火的沉默世界).",
     themeSong: { titleEn: "Set Fire to the Silent World", titleCn: "着火的沉默世界", youtubeId: "7FXGhAmHIAo" },
-    featured: true,
+    featured: true, highlights: ["Major fantasy production under Ju Jingyi Studio", "Lead promotional single 'Set Fire to the Silent World'"],
+  },
+  {
+    id: "lets-fight-upcoming", alias: "lets-fight", titleEn: "Let's Fight", titleCn: "来战", year: 2026,
+    category: "modern-drama", role: "Lead Role", platform: "Youku",
+    synopsis: "High-octane action fantasy drama showcasing Ju Jingyi's dynamic combat choreography and powerful screen presence.",
+    rating: "9.5/10 (Most Anticipated)", featured: false, highlights: ["Highly anticipated action fantasy production", "Bold new athletic choreography"],
   },
   {
     id: "in-blossom", titleEn: "In Blossom", titleCn: "花间令", year: 2024,
-    category: "historical-drama", role: "Yang Caiwei / Shangguan Zhi (杨采薇 / 上官芷)",
+    category: "historical-drama", role: "Yang Caiwei in Shangguan Zhi's appearance after the face-swap premise (杨采薇 / 上官芷)",
     roleCn: "杨采薇 / 上官芷", episodes: 32, rating: "9.5/10", platform: "Youku",
     synopsis: "Romantic mystery set in ancient China. Yang Caiwei, a woman presumed dead, returns in a new identity to solve mysteries alongside the man who loved her.",
-    featured: true, highlights: ["Popular Actress of the Year — Weibo TV & Video Summit 2024", "Fastest 10,000 popularity index on Youku in 2024", "Acclaimed dual-role performance with contrasting personalities"],
+    featured: true, highlights: ["Popular Actress of the Year — Weibo TV & Video Summit 2024", "Fastest 10,000 popularity index on Youku in 2024", "The performance follows Yang Caiwei's identity in Shangguan Zhi's appearance; it is not two separate characters throughout the story"],
   },
   {
-    id: "sword-fairy-4", titleEn: "Sword and Fairy 4", titleCn: "仙剑四", year: 2024,
+    id: "sword-and-fairy-4", alias: "sword-fairy-4", titleEn: "Sword and Fairy 4", titleCn: "仙剑四", year: 2024,
     category: "xianxia-drama", role: "Han Lingsha (韩菱纱)",
     roleCn: "韩菱纱", episodes: 36, rating: "8.9/10", platform: "iQIYI",
     synopsis: "Adapted from the classic RPG. Han Lingsha, a spirited tomb raider, joins forces with Yun Tianhe on an adventure to save the world.",
     themeSong: { titleEn: "Ru Sha", titleCn: "如纱", youtubeId: "lzDP2MfP3eA" },
     highlights: ["Iconic red costume faithful to the game", "#1 trending on iQIYI across China and Southeast Asia"],
   },
+  {
+    id: "money-bastion-movie", titleEn: "Money Bastion", titleCn: "金钱堡垒", year: 2024,
+    category: "movie", role: "Han Xiaomei (韩小美)",
+    roleCn: "韩小美", episodes: "100 min Feature Film", rating: "8.6/10", platform: "Theatrical Release",
+    synopsis: "Crime psychological thriller directed by Oxide Pang. Ju Jingyi stars as Han Xiaomei alongside Wang Qianyuan and Feng Shaofeng, marking her theatrical feature film debut.",
+    featured: false, highlights: ["Ju Jingyi's feature theatrical cinema debut", "Collaboration with veteran acclaimed actors Wang Qianyuan and Feng Shaofeng"],
+  },
   {
     id: "beauty-of-resilience", titleEn: "Beauty of Resilience", titleCn: "花戎", year: 2023,
     category: "xianxia-drama", role: "Wei Zhi / Sima Wangyue / A Ya (魏枝 / 司马忘月 / 阿涯)",
@@ -54,7 +67,7 @@ export const worksData = [
     highlights: ["Most Popular Actress — Tencent Video Starlight Awards 2021", "Viral bead headdress fashion trend"],
   },
   {
-    id: "ruyi-pavilion", titleEn: "The Blooms at Ruyi Pavilion", titleCn: "如意芳霏", year: 2020,
+    id: "the-blooms-at-ruyi-pavilion", alias: "ruyi-pavilion", titleEn: "The Blooms at Ruyi Pavilion", titleCn: "如意芳霏", year: 2020,
     category: "historical-drama", role: "Fu Rong (傅容)",
     roleCn: "傅容", episodes: 40, rating: "9.2/10", platform: "iQIYI",
     synopsis: "Fu Rong, the second daughter of the Fu family, has prophetic dreams. She tries to escape her predicted fate of marrying Prince Su, but finds love instead.",
@@ -66,10 +79,11 @@ export const worksData = [
     category: "historical-drama", role: "Xue Wenxi / Wen Bin (雪文曦 / 文彬)",
     roleCn: "雪文曦 / 文彬", episodes: 36, rating: "8.8/10", platform: "iQIYI",
     synopsis: "Romantic comedy. Xue Wenxi disguises herself as a man to earn a living, accidentally entering an all-male academy where she forms the 'Four Scholars of Yunshang'.",
+    themeSong: { titleEn: "Zhuo Guang Qu", titleCn: "琢光曲", youtubeId: "JNAbdAxiG9E" },
     highlights: ["Breakthrough Actress — iQIYI Scream Night 2020", "Iconic male-disguise look went viral across Asia"],
   },
   {
-    id: "legend-of-white-snake", titleEn: "The Legend of White Snake", titleCn: "新白娘子传奇", year: 2019,
+    id: "the-legend-of-white-snake", alias: "legend-of-white-snake", titleEn: "The Legend of White Snake", titleCn: "新白娘子传奇", year: 2019,
     category: "fantasy-drama", role: "Bai Suzhen (白素贞)",
     roleCn: "白素贞", episodes: 36, rating: "9.3/10", platform: "iQIYI",
     synopsis: "Modern retelling of the classic Chinese legend. Bai Suzhen, a white snake spirit, falls in love with mortal scholar Xu Xian and opens a medical clinic.",
@@ -77,28 +91,48 @@ export const worksData = [
     highlights: ["Drama Actress of the Year — iQIYI Scream Night 2019", "Official remake of the 1992 classic, aired in 10+ countries"],
   },
   {
-    id: "please-give-me-wings", titleEn: "Please Give Me a Pair of Wings", titleCn: "请赐我一双翅膀", year: 2019,
+    id: "please-give-me-a-pair-of-wings", alias: "please-give-me-wings", titleEn: "Please Give Me a Pair of Wings", titleCn: "请赐我一双翅膀", year: 2019,
     category: "modern-drama", role: "Lin Jiuge (林九歌)",
     roleCn: "林九歌", episodes: 60, platform: "iQIYI",
     synopsis: "A modern crime thriller. Lin Jiuge is wrongly imprisoned and must fight to prove her innocence while uncovering a larger conspiracy.",
+    themeSong: { titleEn: "A Pair of Wings", titleCn: "一双翅膀", youtubeId: "L0wwTYE5kpE" },
   },
   {
     id: "legend-of-yunxi", titleEn: "Legend of Yunxi", titleCn: "芸汐传", year: 2018,
     category: "historical-drama", role: "Han Yunxi (韩芸汐)",
     roleCn: "韩芸汐", episodes: 48, rating: "9.0/10", platform: "iQIYI",
     synopsis: "Breakthrough role. A talented female physician navigates palace intrigue and romance with Prince Long Feiye.",
+    themeSong: { titleEn: "Sigh of Yunxi", titleCn: "叹云兮", youtubeId: "oEgxqij58LQ" },
     featured: true, highlights: ["Breakthrough Actress — Weibo TV & Video Summit 2018", "Launched Ju Jingyi to top-tier actress status"],
   },
   {
-    id: "the-fallen-flowers", titleEn: "The Fallen Flowers", titleCn: "热血长安", year: 2017,
-    category: "historical-drama", role: "Shangguan Wan'er (上官婉儿)",
-    roleCn: "上官婉儿", episodes: 48, platform: "Youku",
-    synopsis: "Historical mystery drama set in the Tang Dynasty. Shangguan Wan'er solves cases alongside a team of investigators.",
+    id: "mr-swimmer", titleEn: "Mr. Swimmer", titleCn: "游泳先生", year: 2018,
+    category: "modern-drama", role: "Song Chacha (宋茶茶)",
+    roleCn: "宋茶茶", episodes: 46, rating: "8.5/10", platform: "Mango TV",
+    synopsis: "Modern youth sports romance drama. Song Chacha, a former rich girl who stays optimistic despite family misfortune, finds love with swimmer Bai Yongze (Mike Angelo).",
+    themeSong: { titleEn: "Missing You", titleCn: "想你了", youtubeId: "5F3k9b47Zio" },
+    highlights: ["International co-star pairing with Thai actor Mike Angelo", "Energetic modern romantic comedy role"],
+  },
+  {
+    id: "detective-samoyeds", titleEn: "Detective Samoyeds", titleCn: "热血长安", year: 2017,
+    category: "historical-drama", role: "Shangguan Zisu (上官紫苏)",
+    roleCn: "上官紫苏", episodes: 48, platform: "Youku",
+    synopsis: "Historical mystery drama set in the Tang Dynasty. Shangguan Zisu, known as the 'walking library' of Chang'an, solves cases alongside a team of investigators.",
+  },
+  {
+    id: "novoland-castle-in-the-sky", titleEn: "Novoland: The Castle in the Sky", titleCn: "九州·天空城", year: 2016,
+    category: "fantasy-drama", role: "Xue Feishuang (雪飞霜) — Princess of Winged Clan",
+    roleCn: "雪飞霜", episodes: 28, rating: "8.8/10", platform: "Tencent Video / Jiangsu TV",
+    synopsis: "Epic fantasy series. Ju Jingyi portrays Xue Feishuang, the proud and tragic Princess of the Winged Clan. Her performance and OST 'Zui Fei Shuang' earned widespread acclaim.",
+    themeSong: { titleEn: "Drunk Fei Shuang", titleCn: "醉飞霜", youtubeId: "VTyNNuUsKzM" },
+    highlights: ["Breakthrough fantasy performance as Princess of the Winged Clan", "Iconic character song '醉飞霜' became a classic staple"],
   },
   {
-    id: "novoland-eagle-flag", titleEn: "Novoland: Eagle Flag", titleCn: "九州·天空城II", year: 2020,
-    category: "fantasy-drama", role: "Feng Ruotong (风如澈)",
-    roleCn: "风如澈", episodes: 34, platform: "Tencent Video",
-    synopsis: "Fantasy sequel. Feng Ruotong, a spirited girl, discovers her destiny in a world of warring fantasy kingdoms.",
+    id: "love-under-the-full-moon", titleEn: "Love Under the Full Moon", titleCn: "满月之下请相爱", year: 2021,
+    category: "modern-drama", role: "Lei Chuxia (雷初夏)",
+    roleCn: "雷初夏", episodes: 24, rating: "8.7/10", platform: "iQIYI",
+    synopsis: "Romantic fantasy. Lei Chuxia loses her memory during a full moon phenomenon and crosses time to meet game developer Xu Xiaodong.",
+    themeSong: { titleEn: "Past Perfect", titleCn: "过去完成时", youtubeId: "GzmxD3P1o9Y" },
+    highlights: ["Sci-fi modern romance pairing with Zheng Yecheng", "Viral contemporary fashion styling"],
   },
 ];

package/server/mcp/dataAdapter.js

@@ -74,14 +74,16 @@ export function getUnifiedAwards() {
 }
 
 export function getUnifiedBrands() {
-  return brandsData.map(b => ({
+  const list = Array.isArray(brandsData) ? brandsData : (brandsData.brandList || []);
+  return list.map(b => ({
     id: b.id,
-    brandNameEn: b.brand || b.nameEn || '',
-    brandNameCn: b.brandCn || b.nameCn || b.brand || '',
+    brandNameEn: b.brandNameEn || b.brand || b.nameEn || '',
+    brandNameCn: b.brandNameCn || b.brandCn || b.nameCn || b.brand || '',
     title: b.title || 'Brand Ambassador',
     year: b.year,
     isGlobal: Boolean(b.isGlobal),
     category: b.category || 'Beauty / Fashion',
+    highlight: b.highlight || '',
   })).sort((a, b) => (b.year || 0) - (a.year || 0));
 }
 

package/server/mcp/handler.js

@@ -1,6 +1,6 @@
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { createMcpServer } from './server.js';
-import { checkRateLimit, securityMiddleware, MAX_REQUEST_BODY_SIZE } from './security.js';
+import { checkRateLimit, securityMiddleware, validateApiKey, MAX_REQUEST_BODY_SIZE } from './security.js';
 
 function sendJson(res, statusCode, payload, headers = {}) {
   if (res.headersSent) return;
@@ -31,15 +31,6 @@ export async function handleMcpHttp(req, res) {
   const security = securityMiddleware(req, res);
   if (security.blocked || !validateRequestSize(req, res)) return;
 
-  if (req.method === 'OPTIONS') {
-    res.statusCode = 204;
-    res.setHeader('Access-Control-Allow-Origin', '*');
-    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With, X-API-Key, Accept');
-    res.end();
-    return;
-  }
-
   if (req.method !== 'POST') {
     res.setHeader('Allow', 'GET, POST, OPTIONS');
     return sendJson(res, 405, {
@@ -53,7 +44,10 @@ export async function handleMcpHttp(req, res) {
   if (!rate.allowed) return sendJson(res, 429, { error: rate.error }, { 'Retry-After': '60' });
   res.setHeader('X-RateLimit-Remaining', String(rate.remaining));
 
-  const server = createMcpServer();
+  // Privileged MCP tools (filesystem, secrets, skill management) are only reachable
+  // when the server has MCP_API_KEY configured AND this request carries the matching key.
+  const authorized = !!process.env.MCP_API_KEY && validateApiKey(req).valid;
+  const server = createMcpServer({ transport: 'http', authorized });
   const transport = new StreamableHTTPServerTransport({
     sessionIdGenerator: undefined,
     enableJsonResponse: true,

package/server/mcp/prompts.js

@@ -26,6 +26,30 @@ export const promptDefinitions = [
     description: 'Get a summary of Ju Jingyi\'s brand endorsement portfolio and commercial influence.',
     arguments: [],
   },
+  {
+    name: 'draft_fan_fiction',
+    description: 'Draft creative fan fiction scenarios incorporating authentic Ju Jingyi characters and lore.',
+    arguments: [
+      { name: 'character', description: 'Character name (e.g. "Yang Caiwei", "Han Yunxi", "Fu Rong")', required: true },
+      { name: 'theme', description: 'Story theme or mood (mystery, romance, fantasy adventure)', required: false },
+      { name: 'setting', description: 'Story backdrop or scenario', required: false },
+    ],
+  },
+  {
+    name: 'analyze_drama_rating',
+    description: 'Provide an analytical overview of a drama\'s reception, milestones, and iconic performances.',
+    arguments: [
+      { name: 'title', description: 'Drama title (e.g. "In Blossom", "Legend of Yunxi")', required: true },
+    ],
+  },
+  {
+    name: 'compare_discography_era',
+    description: 'Compare musical styles and evolution across Ju Jingyi\'s idol, solo, and studio eras.',
+    arguments: [
+      { name: 'era_a', description: 'First era (e.g. "snh48", "solo_early", "studio_era")', required: false },
+      { name: 'era_b', description: 'Second era (e.g. "modern", "solo")', required: false },
+    ],
+  },
 ];
 
 function recommendSeries({ mood, genre } = {}) {
@@ -127,6 +151,64 @@ function brandPortfolio() {
   return { messages: [{ role: 'user', content: { type: 'text', text } }] };
 }
 
+function draftFanFiction({ character, theme, setting } = {}) {
+  const charName = character || 'Yang Caiwei';
+  const match = worksData.find(w => w.role.toLowerCase().includes(charName.toLowerCase())) || worksData[0];
+
+  const promptText = `# Ju Jingyi Fan Fiction Prompt: ${charName}
+
+**Protagonist:** ${match.role} (from *${match.titleEn}* / ${match.titleCn})
+**Setting / Context:** ${setting || 'Ancient Heyang city lantern festival market during an unsolved mystery investigation.'}
+**Theme & Mood:** ${theme || 'Poetic romance, wits, resilience, and thrilling investigation'}
+
+**Scene Starter Guidelines:**
+- Maintain authentic character traits: keen intellect, quiet grace, courageous heart.
+- Incorporate period-accurate sensory details: tea fragrance, silk robes, plum blossom rain.
+- Explore meaningful dialogue and suspenseful plot progression.`;
+
+  return { messages: [{ role: 'user', content: { type: 'text', text: promptText } }] };
+}
+
+function analyzeDramaRating({ title } = {}) {
+  const q = (title || '').toLowerCase();
+  const match = worksData.find(w => w.titleEn.toLowerCase().includes(q) || w.titleCn.includes(q)) || worksData[0];
+
+  const analysisText = `# Drama Critical Analysis: ${match.titleEn} (${match.titleCn}, ${match.year})
+
+- **Character Portrayed:** ${match.role}
+- **Category & Platform:** ${match.category} • ${match.platform || 'iQIYI / Youku / Tencent'}
+- **Critical Milestone:** ${match.featured ? 'Featured Masterpiece / Flagship Production' : 'Key Career Milestone'}
+- **Synopsis Context:** ${match.synopsis || 'Comprehensive historical drama production.'}
+
+### Performance Analysis & Impact:
+1. **Character Arc:** Layered portrayal combining subtle emotional restraint and expressive intensity.
+2. **Costume & Visual Aesthetics:** Landmark traditional styling that generated widespread viral discussion across Asian social platforms.
+3. **Soundtrack Synergy:** Memorable OST theme integration highlighting emotional climaxes.`;
+
+  return { messages: [{ role: 'user', content: { type: 'text', text: analysisText } }] };
+}
+
+function compareDiscographyEra({ era_a, era_b } = {}) {
+  const eraA = era_a || 'SNH48 Idol Era (2013-2017)';
+  const eraB = era_b || 'Independent Studio Era (2024-2026)';
+
+  const text = `# Ju Jingyi Discography Era Comparison: ${eraA} vs ${eraB}
+
+## 1. SNH48 Senbatsu & Idol Foundation (2013–2017)
+- **Vocal Style:** Energetic, youthful group harmonies with prominent solo violin performances (*Everyday*, *Princess's Cloak*).
+- **Themes:** Star-seeking dreams, stage companionship, high-tempo pop choreography.
+
+## 2. Solo Breakthrough & Historical OST Era (2018–2023)
+- **Vocal Style:** Breathy, emotive classical balladry with traditional Chinese instrumentation (*Don't Touch / 叹云兮*, *Fu Sheng / 浮生*).
+- **Themes:** Epic drama romance, bittersweet devotion, poignant period melodies.
+
+## 3. Independent Studio & Modern Pop Evolution (2024–2026)
+- **Vocal Style:** Polished modern production, diverse electronic/indie elements, mature artistic control.
+- **Themes:** Self-discovery, artistic independence, sophisticated vocal phrasing.`;
+
+  return { messages: [{ role: 'user', content: { type: 'text', text } }] };
+}
+
 // ── Dispatch ──
 
 const promptHandlers = {
@@ -134,6 +216,9 @@ const promptHandlers = {
   character_summary: characterSummary,
   career_overview: careerOverview,
   brand_portfolio: brandPortfolio,
+  draft_fan_fiction: draftFanFiction,
+  analyze_drama_rating: analyzeDramaRating,
+  compare_discography_era: compareDiscographyEra,
 };
 
 export async function getPrompt(name, args = {}) {
@@ -141,3 +226,4 @@ export async function getPrompt(name, args = {}) {
   if (!handler) throw new Error(`Unknown prompt: ${name}`);
   return handler(args);
 }
+

package/server/mcp/security.js

@@ -10,7 +10,7 @@ const SECURITY_CONFIG = {
   sessionTtlMs: 30 * 60_000,
   maxMessagesPerSession: 500,
 
-  corsAllowedOrigins: (process.env.MCP_CORS_ORIGINS || '*').split(',').map(s => s.trim()),
+  corsAllowedOrigins: (process.env.MCP_CORS_ORIGINS || '').split(',').map(s => s.trim()).filter(Boolean),
   maxRequestBodyBytes: 1_048_576,
 };
 
@@ -21,13 +21,12 @@ export function validateApiKey(req) {
 
   let key = req.headers['x-api-key'];
   if (!key) {
-    try {
-      const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
-      key = url.searchParams.get('key') || url.searchParams.get('apiKey');
-    } catch {
+    const authHeader = req.headers['authorization'];
+    if (authHeader && typeof authHeader === 'string' && authHeader.startsWith('Bearer ')) {
+      key = authHeader.slice(7).trim();
     }
   }
-  if (!key) return { valid: false, error: 'Missing API key. Set X-API-Key header or ?key= query parameter.' };
+  if (!key) return { valid: false, error: 'Missing API key. Set X-API-Key header or Authorization: Bearer <key>.' };
   const expected = Buffer.from(process.env.MCP_API_KEY || '');
   const received = Buffer.from(String(key));
   if (expected.length !== received.length || !timingSafeEqual(expected, received)) {
@@ -89,20 +88,24 @@ export function validateSessionId(sessionId) {
   return /^[a-zA-Z0-9_-]{1,100}$/.test(sessionId);
 }
 
-export function setCorsHeaders(res, origin) {
-  const allowed = SECURITY_CONFIG.corsAllowedOrigins;
-  const isAllowed = allowed.includes('*') || allowed.includes(origin);
-
-  if (isAllowed) {
-    res.setHeader('Access-Control-Allow-Origin', origin || '*');
-  } else {
-    res.setHeader('Access-Control-Allow-Origin', '');
-  }
+export function setCorsHeaders(res, origin) {
+  const allowed = SECURITY_CONFIG.corsAllowedOrigins;
+  const isLocalhost = process.env.NODE_ENV !== 'production' &&
+    (origin.startsWith('http://localhost:') || origin.startsWith('http://127.0.0.1:') || origin === 'http://localhost' || origin === 'http://127.0.0.1');
+  const isAllowed = !origin || allowed.includes(origin) || isLocalhost;
+
+  if (origin && isAllowed) {
+    res.setHeader('Access-Control-Allow-Origin', origin);
+    res.setHeader('Vary', 'Origin');
+  }
   res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
   res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With, X-API-Key, Accept');
   res.setHeader('Access-Control-Max-Age', '86400');
   res.setHeader('X-Content-Type-Options', 'nosniff');
   res.setHeader('X-Frame-Options', 'DENY');
+  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+  res.setHeader('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload');
+  res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
 
   return isAllowed;
 }

package/server/mcp/server.js

@@ -5,7 +5,12 @@ import { toolDefinitions, handleToolCall } from './tools.js';
 import { resourceDefinitions, readResource } from './resources.js';
 import { getPrompt } from './prompts.js';
 
-export function createMcpServer() {
+export function createMcpServer(options = {}) {
+  const toolOptions = {
+    transport: options.transport || 'stdio',
+    authorized: options.authorized === true,
+  };
+
   const server = new McpServer({
     name: 'kiku',
     title: 'kiku',
@@ -56,7 +61,7 @@ export function createMcpServer() {
       },
       async (args) => {
         try {
-          const result = await handleToolCall(tool.name, args);
+          const result = await handleToolCall(tool.name, args, toolOptions);
           return {
             content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
             structuredContent: result,

package/server/mcp/tools.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { executeTool, toolsSchema } from '../agent/tools.js';
 
+// Rich catalog/database tools — safe to expose over public MCP.
 const PUBLIC_TOOL_NAMES = new Set([
   'get_profile_and_fandom',
   'get_quotes',
@@ -19,9 +20,59 @@ const PUBLIC_TOOL_NAMES = new Set([
   'get_system_stats',
 ]);
 
-const OPTIONAL_WEB_TOOL_NAMES = new Set(['web_search', 'fetch_webpage', 'fetch_api', 'fetch_json', 'web_extract']);
+// Web tools — gated behind KIKU_MCP_ENABLE_WEB_TOOLS flag.
+const OPTIONAL_WEB_TOOL_NAMES = new Set(['web_search', 'fetch_webpage', 'fetch_api', 'web_extract']);
 const webToolsEnabled = process.env.KIKU_MCP_ENABLE_WEB_TOOLS === 'true';
 
+// Anonymous callers may search public music metadata, but cannot mutate playback state.
+const MUSIC_TOOL_NAMES = new Set([
+  'search_youtube',
+]);
+
+// Stateless engagement tools are safe to expose.
+const RESEARCH_TOOL_NAMES = new Set([
+  'suggest_topics',
+  'run_quiz',
+]);
+
+// Privileged tools — they touch the filesystem, server-local resources, secrets, or
+// mutated server state. Exposed over MCP but REQUIRE authorization (a valid MCP_API_KEY
+// / X-API-Key / Bearer header). Never callable anonymously on the public HTTP endpoint.
+const PRIVILEGED_TOOL_NAMES = new Set([
+  'read_local_file',
+  'list_directory',
+  'screenshot_webpage',
+  'get_api_key',
+  'manage_skill',
+  'play_music',
+  'stop_music',
+  'mute_music',
+  'unmute_music',
+  'pause_music',
+  'resume_music',
+  'next_track',
+  'prev_track',
+  'add_to_queue',
+  'remove_from_queue',
+  'clear_queue',
+  'get_queue',
+  'get_current_track',
+  'get_music_status',
+  'run_subagent',
+  'run_deep_research',
+  'verify_claim',
+  'fetch_json',
+]);
+
+// Any tool that is not privileged is public.
+const isPrivileged = (name) => PRIVILEGED_TOOL_NAMES.has(name);
+
+function isAllowedTool(name) {
+  if (PUBLIC_TOOL_NAMES.has(name) || MUSIC_TOOL_NAMES.has(name) || RESEARCH_TOOL_NAMES.has(name)) return true;
+  if (OPTIONAL_WEB_TOOL_NAMES.has(name)) return webToolsEnabled;
+  return PRIVILEGED_TOOL_NAMES.has(name);
+}
+
 const COMPATIBILITY_ALIASES = Object.freeze({
   get_profile: 'get_profile_and_fandom',
   get_timeline: 'get_career_timeline',
@@ -52,7 +103,7 @@ function jsonSchemaToZodShape(schema = {}) {
 
 const sourceDefinitions = toolsSchema
   .map(tool => tool.function)
-  .filter(tool => PUBLIC_TOOL_NAMES.has(tool.name) || (webToolsEnabled && OPTIONAL_WEB_TOOL_NAMES.has(tool.name)));
+  .filter(tool => isAllowedTool(tool.name));
 
 const sourceByName = new Map(sourceDefinitions.map(tool => [tool.name, tool]));
 
@@ -100,6 +151,19 @@ export async function handleToolCall(toolName, args = {}, options = {}) {
     };
   }
 
+  const transport = options.transport || 'stdio';
+  if (isPrivileged(definition.targetName)) {
+    const authorized = options.authorized === true || transport === 'stdio';
+    if (!authorized) {
+      return {
+        status: 'error',
+        code: 'requires_authorization',
+        message: `The "${toolName}" tool is privileged and requires a valid MCP API key (set MCP_API_KEY and send it via X-API-Key or Authorization: Bearer).`,
+        availableTools: toolDefinitions.map(tool => tool.name),
+      };
+    }
+  }
+
   const adaptedArgs = { ...(args || {}) };
   if (toolName === 'search_gallery') delete adaptedArgs.query;
   if (adaptedArgs.category && definition.targetName === 'search_discography' && !adaptedArgs.type) {

package/server/web-chat/core/browserLauncher.js

@@ -0,0 +1,18 @@
+import { spawn } from 'node:child_process';
+
+export function openBrowser(url, defaultPort = 3001) {
+  const targetUrl = String(url || `http://localhost:${defaultPort}`);
+  const platform = process.platform;
+  try {
+    if (platform === 'win32') {
+      spawn('cmd', ['/c', 'start', '""', targetUrl], { detached: true, stdio: 'ignore' }).unref();
+    } else if (platform === 'darwin') {
+      spawn('open', [targetUrl], { detached: true, stdio: 'ignore' }).unref();
+    } else {
+      spawn('xdg-open', [targetUrl], { detached: true, stdio: 'ignore' }).unref();
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}