loomiomcp 0.0.8 → 0.0.9

package/README.md

@@ -13,7 +13,7 @@ analyse member activity — in plain English. Targets Loomio's **b2** API
 [/help/api2](https://www.loomio.com/help/api2) and the namespace where
 the controllers actually live in the open-source repo.
 
-Tools (b2, per-user `?api_key=`):
+Tools (b2, per-user API key):
 
 - `get_discussion(id_or_key)` — fetch one discussion
 - `list_discussions(group_id, status?, limit?, offset?)` — list a group's discussions
@@ -45,7 +45,7 @@ Tools (b2, per-user `?api_key=`):
   `remove_absent`.
 - `create_comment(discussion_id, body, body_format?)` — reply on a discussion
 
-Opt-in admin tools (b3, server-instance secret `?b3_api_key=`):
+Opt-in admin tools (b3, server-instance secret):
 
 Set `LOOMIO_B3_API_KEY` to enable. Only useful for Loomio instance operators.
 
@@ -67,13 +67,23 @@ See DEPLOY.md for Cloud Run.
 
 ## Auth
 
-Loomio's b2 API authenticates by API key passed as a `?api_key=…` query
-parameter. The connector injects it server-side; it never reaches the
-MCP client. Generate one in Loomio under your profile → API keys.
+Loomio authenticates by API key sent in an HTTP bearer header:
 
-The optional b3 admin namespace uses a different secret (`?b3_api_key=…`,
-validated against `ENV['B3_API_KEY']` on the Loomio server, >16 chars).
-Only relevant if you operate a Loomio instance.
+```text
+Authorization: Bearer <API_KEY>
+```
+
+The connector injects it server-side; it never reaches the MCP client.
+Generate one in Loomio under your profile → API keys.
+
+Keys passed in the query string (`?api_key=…`) are **rejected** — Loomio
+removed that scheme in July 2026 because URLs are retained in browser
+history, proxy logs, and monitoring systems. A request carrying its key
+that way is treated as unauthenticated and 403s.
+
+The optional b3 admin namespace uses the same bearer header with a
+different secret (validated against `ENV['B3_API_KEY']` on the Loomio
+server, >16 chars). Only relevant if you operate a Loomio instance.
 
 ## Read-only mode
 

package/dist/http.js

@@ -213,9 +213,9 @@ async function handleResponse(res) {
     throw err;
   }
 }
-var B2_AUTH = { field: "api_key", getValue: getApiKey };
-var B3_AUTH = { field: "b3_api_key", getValue: getB3ApiKey };
-function buildUrl(auth, path, params) {
+var B2_AUTH = getApiKey;
+var B3_AUTH = getB3ApiKey;
+function buildUrl(path, params) {
   const url = new URL(`${baseUrl()}${path}`);
   if (params) {
     for (const [key, value] of Object.entries(params)) {
@@ -224,9 +224,14 @@ function buildUrl(auth, path, params) {
       }
     }
   }
-  url.searchParams.set(auth.field, auth.getValue());
   return url.toString();
 }
+function authHeaders(auth) {
+  return {
+    ...baseHeaders(),
+    Authorization: `Bearer ${auth()}`
+  };
+}
 async function doFetch(url, options) {
   const startedAt = Date.now();
   const method = options?.method ?? "GET";
@@ -258,8 +263,8 @@ function emitLoomioRequest(method, url, res, durationMs) {
   });
 }
 async function loomioGet(path, params) {
-  const url = buildUrl(B2_AUTH, path, params);
-  const start = await doFetch(url, { headers: baseHeaders() });
+  const url = buildUrl(path, params);
+  const start = await doFetch(url, { headers: authHeaders(B2_AUTH) });
   try {
     return await consumeBody(start, () => handleResponse(start.res));
   } finally {
@@ -267,8 +272,8 @@ async function loomioGet(path, params) {
   }
 }
 async function loomioGetStatus(path, params) {
-  const url = buildUrl(B2_AUTH, path, params);
-  const start = await doFetch(url, { headers: baseHeaders() });
+  const url = buildUrl(path, params);
+  const start = await doFetch(url, { headers: authHeaders(B2_AUTH) });
   try {
     return await consumeBody(start, async () => {
       try {
@@ -295,12 +300,12 @@ function encodeForm(body) {
 }
 async function loomioPost(path, body, opts = {}) {
   if (isReadOnly()) throw new LoomioReadOnlyError("POST");
-  const url = buildUrl(B2_AUTH, path, opts.params);
+  const url = buildUrl(path, opts.params);
   const encoding = opts.encoding ?? "json";
   const start = await doFetch(url, {
     method: "POST",
     headers: {
-      ...baseHeaders(),
+      ...authHeaders(B2_AUTH),
       "Content-Type": encoding === "form" ? "application/x-www-form-urlencoded" : "application/json"
     },
     body: encoding === "form" ? encodeForm(body) : JSON.stringify(body)
@@ -313,10 +318,10 @@ async function loomioPost(path, body, opts = {}) {
 }
 async function loomioPostB3(path, params) {
   if (isReadOnly()) throw new LoomioReadOnlyError("POST");
-  const url = buildUrl(B3_AUTH, path, params);
+  const url = buildUrl(path, params);
   const start = await doFetch(url, {
     method: "POST",
-    headers: { ...baseHeaders(), "Content-Type": "application/json" },
+    headers: { ...authHeaders(B3_AUTH), "Content-Type": "application/json" },
     body: "{}"
   });
   try {
@@ -1700,7 +1705,7 @@ function createLoomioMcpServer() {
   const server = new McpServer({
     name: "loomiomcp",
     // Keep in sync with package.json on each release.
-    version: "0.0.8",
+    version: "0.0.9",
     description: "MCP server for Loomio (loomio.com / self-hosted). Wraps Loomio's b2 public API: read and create discussions, polls, and comments; list and manage group memberships; read per-discussion event streams; and aggregate a user's participation across groups. Read-only mode supported via LOOMIO_MCP_READONLY=1 (Cloud Run pattern). Optional b3 admin operations (deactivate / reactivate user) when LOOMIO_B3_API_KEY is set \u2014 instance operators only. Read tools annotated with readOnlyHint so MCP clients can auto-approve safe calls; destructive writes (manage_memberships with remove_absent, deactivate_user) carry destructiveHint.",
     websiteUrl: "https://github.com/soil-dev/loomiomcp",
     icons: ICONS

package/dist/index.js

@@ -190,9 +190,9 @@ async function handleResponse(res) {
     throw err;
   }
 }
-var B2_AUTH = { field: "api_key", getValue: getApiKey };
-var B3_AUTH = { field: "b3_api_key", getValue: getB3ApiKey };
-function buildUrl(auth, path, params) {
+var B2_AUTH = getApiKey;
+var B3_AUTH = getB3ApiKey;
+function buildUrl(path, params) {
   const url = new URL(`${baseUrl()}${path}`);
   if (params) {
     for (const [key, value] of Object.entries(params)) {
@@ -201,9 +201,14 @@ function buildUrl(auth, path, params) {
       }
     }
   }
-  url.searchParams.set(auth.field, auth.getValue());
   return url.toString();
 }
+function authHeaders(auth) {
+  return {
+    ...baseHeaders(),
+    Authorization: `Bearer ${auth()}`
+  };
+}
 async function doFetch(url, options) {
   const startedAt = Date.now();
   const method = options?.method ?? "GET";
@@ -235,8 +240,8 @@ function emitLoomioRequest(method, url, res, durationMs) {
   });
 }
 async function loomioGet(path, params) {
-  const url = buildUrl(B2_AUTH, path, params);
-  const start = await doFetch(url, { headers: baseHeaders() });
+  const url = buildUrl(path, params);
+  const start = await doFetch(url, { headers: authHeaders(B2_AUTH) });
   try {
     return await consumeBody(start, () => handleResponse(start.res));
   } finally {
@@ -244,8 +249,8 @@ async function loomioGet(path, params) {
   }
 }
 async function loomioGetStatus(path, params) {
-  const url = buildUrl(B2_AUTH, path, params);
-  const start = await doFetch(url, { headers: baseHeaders() });
+  const url = buildUrl(path, params);
+  const start = await doFetch(url, { headers: authHeaders(B2_AUTH) });
   try {
     return await consumeBody(start, async () => {
       try {
@@ -272,12 +277,12 @@ function encodeForm(body) {
 }
 async function loomioPost(path, body, opts = {}) {
   if (isReadOnly()) throw new LoomioReadOnlyError("POST");
-  const url = buildUrl(B2_AUTH, path, opts.params);
+  const url = buildUrl(path, opts.params);
   const encoding = opts.encoding ?? "json";
   const start = await doFetch(url, {
     method: "POST",
     headers: {
-      ...baseHeaders(),
+      ...authHeaders(B2_AUTH),
       "Content-Type": encoding === "form" ? "application/x-www-form-urlencoded" : "application/json"
     },
     body: encoding === "form" ? encodeForm(body) : JSON.stringify(body)
@@ -290,10 +295,10 @@ async function loomioPost(path, body, opts = {}) {
 }
 async function loomioPostB3(path, params) {
   if (isReadOnly()) throw new LoomioReadOnlyError("POST");
-  const url = buildUrl(B3_AUTH, path, params);
+  const url = buildUrl(path, params);
   const start = await doFetch(url, {
     method: "POST",
-    headers: { ...baseHeaders(), "Content-Type": "application/json" },
+    headers: { ...authHeaders(B3_AUTH), "Content-Type": "application/json" },
     body: "{}"
   });
   try {
@@ -1049,7 +1054,7 @@ function createLoomioMcpServer() {
   const server2 = new McpServer({
     name: "loomiomcp",
     // Keep in sync with package.json on each release.
-    version: "0.0.8",
+    version: "0.0.9",
     description: "MCP server for Loomio (loomio.com / self-hosted). Wraps Loomio's b2 public API: read and create discussions, polls, and comments; list and manage group memberships; read per-discussion event streams; and aggregate a user's participation across groups. Read-only mode supported via LOOMIO_MCP_READONLY=1 (Cloud Run pattern). Optional b3 admin operations (deactivate / reactivate user) when LOOMIO_B3_API_KEY is set \u2014 instance operators only. Read tools annotated with readOnlyHint so MCP clients can auto-approve safe calls; destructive writes (manage_memberships with remove_absent, deactivate_user) carry destructiveHint.",
     websiteUrl: "https://github.com/soil-dev/loomiomcp",
     icons: ICONS

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loomiomcp",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "description": "Model Context Protocol server for Loomio. Lets Claude (Desktop, Code, or web Projects via Custom Connector) read and create Loomio discussions, polls, and comments, manage group memberships, and analyse member activity in plain English.",
   "keywords": [
     "mcp",