kitsune-mcp 0.8.3 → 0.9.0

package/README.md

@@ -8,6 +8,7 @@
 [![PyPI](https://img.shields.io/pypi/v/kitsune-mcp?color=blue)](https://pypi.org/project/kitsune-mcp/)
 [![Python](https://img.shields.io/pypi/pyversions/kitsune-mcp)](https://pypi.org/project/kitsune-mcp/)
 [![CI](https://github.com/kaiser-data/kitsune-mcp/actions/workflows/test.yml/badge.svg)](https://github.com/kaiser-data/kitsune-mcp/actions)
+[![Coverage](https://codecov.io/gh/kaiser-data/kitsune-mcp/branch/main/graph/badge.svg)](https://codecov.io/gh/kaiser-data/kitsune-mcp)
 [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
 [![Smithery](https://smithery.ai/badge/@kaiser-data/kitsune-mcp)](https://smithery.ai/server/@kaiser-data/kitsune-mcp)
 [![Discord](https://img.shields.io/badge/Discord-Join-5865F2?logo=discord&logoColor=white)](https://discord.gg/EYgcf7EX)
@@ -262,6 +263,8 @@ Every `shapeshift()`, `call()`, and `connect()` result shows where the server co
 | Medium | `mcpregistry`, `glama`, `smithery` | `✓ Source: smithery` |
 | Community | `npm`, `pypi`, `github` | `⚠️ Source: npm (community — not verified)` |
 
+Community servers and `source="local"` installs require `confirm=True` — you're explicitly acknowledging you've reviewed the server before running arbitrary code. To bypass this for servers you already trust, set `KITSUNE_TRUST=community` (via `key("KITSUNE_TRUST", "community")` or your `.env`). This persists across sessions so power users and agents never see the gate again.
+
 ### Install command validation
 
 Before spawning any subprocess, Kitsune MCP validates the executable name:
@@ -322,7 +325,7 @@ call("create_issue", arguments={"owner": "…", "repo": "…", "title": "…"})
 Kitsune MCP re-reads `.env` on every call — which means adding a key instantly activates it. That convenience comes with a responsibility: **`.env` is the single place all your API keys live**. A few practices worth following:
 
 - Add `.env` to `.gitignore` — never commit real keys
-- Use project-level `.env` for project-specific keys; `~/.chameleon/.env` for personal global keys
+- Use project-level `.env` for project-specific keys; `~/.kitsune/.env` for personal global keys
 - Prefer minimal OAuth scopes and fine-grained tokens (e.g. GitHub fine-grained tokens with per-repo permissions)
 - Rotate keys that get exposed; Kitsune MCP picks up the new value immediately without restart
 
@@ -334,7 +337,7 @@ Kitsune MCP re-reads `.env` on every call — which means adding a key instantly
 
 **"What about MCP Inspector?"** — MCP Inspector is a standalone web UI that connects to one server and lets you inspect schemas and call tools manually. It's useful for basic debugging but isolated from real AI workflows. Kitsune MCP tests servers inside actual Claude or Cursor sessions — how an AI really uses them. It adds `test()` scoring, `bench()` latency numbers, side-by-side server comparison, and `craft()` for live endpoint prototyping. It also discovers and installs servers on demand; Inspector requires you to already have one running.
 
-**"What about `mcp-dynamic-proxy`?"** — It hides tools behind `call_tool("brave", "web_search", {...})` — always a wrapper. After `receive("mcp-server-brave-search")`, Kitsune MCP gives you a real native `brave_web_search` with the actual schema. It also can't discover or install packages at runtime.
+**"What about `mcp-dynamic-proxy`?"** — It hides tools behind `call_tool("brave", "web_search", {...})` — always a wrapper. After `shapeshift("mcp-server-brave-search")`, Kitsune MCP gives you a real native `brave_web_search` with the actual schema. It also can't discover or install packages at runtime.
 
 **"Can FastMCP do this natively?"**
 
@@ -380,7 +383,7 @@ Get a free key at [smithery.ai/account/api-keys](https://smithery.ai/account/api
 **Frictionless credentials** — Kitsune MCP re-reads `.env` on every `inspect()`, `shapeshift()`, and `call()`. Add a key mid-session and it takes effect immediately — no restart:
 
 ```
-# .env (CWD, ~/.env, or ~/.chameleon/.env — all checked, CWD wins)
+# .env (CWD, ~/.env, or ~/.kitsune/.env — all checked, CWD wins)
 BRAVE_API_KEY=your-key
 GITHUB_TOKEN=ghp_...
 ```
@@ -399,8 +402,8 @@ key("BRAVE_API_KEY", "your-key")   # writes to .env, active immediately
 
 | Tool | Description |
 |---|---|
-| `shapeshift(server_id, tools)` | Load a server's tools live. `tools=[...]` for lean shapeshift. |
-| `shiftback(kill)` | Remove shapeshifted tools. `kill=True` terminates the process immediately. |
+| `shapeshift(server_id, tools, source, confirm)` | Load a server's tools live. `tools=[...]` for lean load. `source="local"` forces npx/uvx install; `source="smithery"` forces HTTP. |
+| `shiftback(kill, uninstall)` | Remove shapeshifted tools. `kill=True` terminates the process. `uninstall=True` also removes a locally installed package. |
 | `search(query, registry)` | Search MCP servers across registries. |
 | `inspect(server_id)` | Show tools, schemas, and live credential status (✓/✗ per key). |
 | `call(tool_name, server_id, args)` | Call a tool. `server_id` optional when shapeshifted — current form used. |
@@ -491,6 +494,16 @@ call("brave_web_search", arguments={"query": "MCP protocol 2025"})
 shiftback()
 ```
 
+### Local install — no API key needed
+
+```
+# Force local install via npx/uvx — no Smithery key required
+shapeshift("brave", source="local", confirm=True)
+# → spawns npx locally, tools appear natively
+call("brave_web_search", arguments={"query": "MCP 2026"})
+shiftback(uninstall=True)   # remove tools AND uninstall the package
+```
+
 ### Persistent server with setup guidance
 
 ```
@@ -508,13 +521,17 @@ shiftback(kill=True)                    # terminates process, frees RAM
 ## Installation
 
 ```bash
-pip install kitsune-mcp        # from PyPI
+uvx kitsune-mcp                # recommended — uv manages the env automatically
+# or
+pip install kitsune-mcp        # classic pip
 # or
-git clone https://github.com/kaiser-data/kitsune-mcp && pip install -e .
+npx kitsune-mcp                # if you prefer npm (delegates to uvx internally)
 ```
 
 **Requirements:** Python 3.12+ · `node`/`npx` (for npm servers) · `uvx` from [uv](https://github.com/astral-sh/uv) (for pip servers)
 
+> **Tip:** `uvx kitsune-mcp` is the easiest way — uv installs into an isolated env automatically. No venv setup needed.
+
 ---
 
 ## Contributing

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kitsune-mcp",
-  "version": "0.8.3",
+  "version": "0.9.0",
   "description": "The shape-shifting MCP hub — shapeshift() into 10,000+ MCP servers at runtime. One entry point, no restarts, 7 registries.",
   "mcpName": "io.github.kaiser-data/kitsune-mcp",
   "bin": {