linkbreakers-mcp 1.183.3 → 1.184.0

package/README.md

@@ -21,24 +21,13 @@ Tools, resources and their schemas come from the hosted server: this package for
 
 ### Authentication
 
-- **OAuth (default):** on the first request, your browser opens the Linkbreakers sign-in. Once you approve, the tools appear. Tokens are stored in `~/.config/linkbreakers/mcp-oauth.json` and refreshed automatically.
-- **API token:** set `LINKBREAKERS_API_TOKEN` to a workspace API token from the [dashboard](https://app.linkbreakers.com) to skip the browser.
+On the first request, your browser opens the Linkbreakers sign-in. Once you approve, the tools appear. Tokens are stored in `~/.config/linkbreakers/mcp-oauth.json` and refreshed automatically.
 
-```json
-{
-  "mcpServers": {
-    "linkbreakers": {
-      "command": "npx",
-      "args": ["-y", "linkbreakers-mcp"],
-      "env": { "LINKBREAKERS_API_TOKEN": "your-workspace-token" }
-    }
-  }
-}
-```
+The MCP server accepts OAuth only: dashboard API tokens are refused, so there
+is nothing to paste. API tokens are for the REST API, the SDKs and the CLI.
 
 | Variable | Default | Purpose |
 | --- | --- | --- |
-| `LINKBREAKERS_API_TOKEN` | unset | Workspace API token, sent as a bearer token |
 | `LINKBREAKERS_MCP_URL` | `https://mcp.linkbreakers.com` | Server to forward to |
 | `LINKBREAKERS_MCP_CALLBACK_PORT` | `47823` | Local port for the OAuth redirect |
 

package/lib/proxy.js

@@ -9,7 +9,6 @@ import { FileOAuthProvider, hasStoredTokens, openBrowser } from './oauth.js';
 
 const { version } = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
 const SERVER_URL = new URL(process.env.LINKBREAKERS_MCP_URL || 'https://mcp.linkbreakers.com');
-const TOKEN = process.env.LINKBREAKERS_API_TOKEN?.trim();
 const REQUEST_TIMEOUT_MS = 5 * 60 * 1000;
 const AUTH_REQUIRED = -32001;
 const DEFAULT_CAPABILITIES = { tools: { listChanged: true }, resources: { listChanged: true } };
@@ -17,15 +16,14 @@ const DEFAULT_CAPABILITIES = { tools: { listChanged: true }, resources: { listCh
 const log = (message) => process.stderr.write(`linkbreakers-mcp: ${message}\n`);
 
 export async function main() {
-  const oauth = TOKEN ? undefined : new FileOAuthProvider(SERVER_URL.href, version);
+  // The MCP server accepts OAuth only: dashboard API tokens are refused.
+  const oauth = new FileOAuthProvider(SERVER_URL.href, version);
   let server;
   let remote;
   let connecting;
   let signIn;
 
-  const transportOptions = TOKEN
-    ? { requestInit: { headers: { Authorization: `Bearer ${TOKEN}` } } }
-    : { authProvider: oauth };
+  const transportOptions = { authProvider: oauth };
 
   async function connectRemote(transport = new StreamableHTTPClientTransport(SERVER_URL, transportOptions)) {
     const client = new Client({ name: 'linkbreakers-mcp', version }, { capabilities: {} });
@@ -38,7 +36,7 @@ export async function main() {
     try {
       await client.connect(transport);
     } catch (err) {
-      if (oauth && err instanceof UnauthorizedError && oauth.authorizationUrl) startSignIn(transport);
+      if (err instanceof UnauthorizedError && oauth.authorizationUrl) startSignIn(transport);
       throw err;
     }
     return client;
@@ -66,12 +64,10 @@ export async function main() {
   }
 
   function authError() {
-    const url = oauth?.authorizationUrl;
+    const url = oauth.authorizationUrl;
     return new McpError(
       AUTH_REQUIRED,
-      TOKEN
-        ? 'Linkbreakers rejected LINKBREAKERS_API_TOKEN. Create a workspace API token at https://app.linkbreakers.com, or unset it to sign in with OAuth.'
-        : `Linkbreakers sign-in required. Finish the OAuth sign-in opened in your browser${url ? ` (${url})` : ''}, or set LINKBREAKERS_API_TOKEN to a workspace API token. Tools appear once you are signed in.`,
+      `Linkbreakers sign-in required. Finish the OAuth sign-in opened in your browser${url ? ` (${url})` : ''}. Tools appear once you are signed in.`,
     );
   }
 
@@ -90,7 +86,7 @@ export async function main() {
     }
   }
 
-  if (TOKEN || hasStoredTokens(SERVER_URL.href)) {
+  if (hasStoredTokens(SERVER_URL.href)) {
     try {
       remote = await connectRemote();
     } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "linkbreakers-mcp",
-  "version": "1.183.3",
+  "version": "1.184.0",
   "mcpName": "com.linkbreakers/mcp",
   "description": "Local stdio bridge to the Linkbreakers MCP server (https://mcp.linkbreakers.com) for MCP clients that only run local servers.",
   "keywords": [