mcp-prompt-optimizer 2.2.3 → 3.0.2

package/CHANGELOG.md

@@ -5,6 +5,49 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.0.1] - 2025-12-09
+
+### Fixed
+- 🔧 **Critical Endpoint Fix**: Corrected quota status endpoint from `/api/v1/api-keys/quota-status` to `/api/v1/mcp/quota-status` for proper API key authentication
+- 📊 **Response Mapping**: Updated quota status response handling to support nested structure returned by MCP endpoint
+- 🎯 **AG-UI Path**: Fixed AG-UI status endpoint path from `/api/v1/agui/status` to `/api/status` to match backend router mounting
+- 🔐 **Authentication**: All quota operations now use API key authentication instead of JWT
+
+### Technical
+- 📋 **Backend Alignment**: Comprehensive endpoint verification against FastAPI Backend production-v2.2.0-stable
+- 📝 **Documentation**: Added `ENDPOINT_VERIFICATION_REPORT.md` with complete endpoint mapping
+- 🚨 **Critical Issue Identified**: Backend MCP router not mounted - requires backend team deployment before v3.0.1 functionality works
+
+### Backend Dependencies
+- ⚠️ **REQUIRED**: Backend must mount MCP router at `/api/v1` prefix for quota status to work
+- ⚠️ **BLOCKER**: Package will fail quota checks until backend is updated
+- 📞 **Action**: Coordinate with backend team before publishing to NPM
+
+### Migration Notes
+- This is a patch release fixing critical endpoint mismatches
+- No breaking changes for users (transparent fixes)
+- Package version changed from v3.0.0 to v3.0.1
+
+## [3.0.0] - 2025-12-08
+
+### Changed (Breaking)
+- 🔐 **Security Hardening**: Development mode permanently disabled for production security
+- ⏱️ **Cache Reduction**: API key cache reduced from 24 hours to 1 hour
+- ⏱️ **Fallback Cache**: Fallback cache reduced from 7 days to 2 hours
+- ❌ **Offline Mode**: Removed offline mode support
+- ❌ **Mock Validation**: Removed development mode API key bypasses
+
+### Security
+- 🛡️ **All API keys** now require backend validation (no client-side bypasses)
+- 🔒 **Environment variables** no longer enable development mode
+- ✅ **Production-only**: Package now enforces backend connectivity
+
+### Migration from v2.x
+- All users must have valid API keys from https://promptoptimizer-blog.vercel.app/pricing
+- `OPTIMIZER_DEV_MODE=true` no longer works (intentionally disabled)
+- Offline usage no longer supported (requires active backend connection)
+- Short-lived caching (1-2 hours) replaces long-term caching
+
 ## [1.5.0] - 2025-09-25
 
 ### Added

package/README.md

@@ -1,7 +1,9 @@
-# MCP Prompt Optimizer v2.2.3
+# MCP Prompt Optimizer v3.0.0
 
 🚀 **Professional cloud-based MCP server** for AI-powered prompt optimization with intelligent context detection, template management, team collaboration, enterprise-grade features, and **optional personal model configuration**. Starting at $2.99/month.
 
+⚠️ **v3.0.0 Breaking Changes:** API key is now REQUIRED for all operations. Development mode and offline mode have been removed for security.
+
 ## ✨ Key Features
 
 🧠 **AI Context Detection** - Automatically detects and optimizes for image generation, LLM interaction, technical automation  
@@ -14,14 +16,18 @@
 
 ## 🚀 Quick Start
 
-**1. Install the MCP server:**
+**1. Get your API key (REQUIRED):**
+
+⚠️ **Important:** An API key is REQUIRED to use this package. Choose your tier:
+
+- **🆓 FREE Tier** (`sk-local-*`): 5 daily optimizations - Get started at [https://promptoptimizer-blog.vercel.app/pricing](https://promptoptimizer-blog.vercel.app/pricing)
+- **⭐ Paid Tiers** (`sk-opt-*`, `sk-team-*`): More optimizations, team features, advanced capabilities
+
+**2. Install the MCP server:**
 ```bash
 npm install -g mcp-prompt-optimizer
 ```
 
-**2. Get your API key:**
-Visit [https://promptoptimizer-blog.vercel.app/pricing](https://promptoptimizer-blog.vercel.app/pricing) for your free tier (`sk-local-*` key, 5 optimizations per day)
-
 **3. Configure Claude Desktop:**
 Add to your `~/.claude/claude_desktop_config.json`:
 ```json
@@ -31,13 +37,15 @@ Add to your `~/.claude/claude_desktop_config.json`:
       "command": "npx",
       "args": ["mcp-prompt-optimizer"],
       "env": {
-        "OPTIMIZER_API_KEY": "sk-local-your-key-here"  // Use sk-local-* for free tier, sk-opt-* for paid subscriptions
+        "OPTIMIZER_API_KEY": "sk-local-your-key-here"  // REQUIRED: Use your API key here
       }
     }
   }
 }
 ```
 
+> **Note:** All API keys are validated against our backend server. Internet connection required (brief caching for reliability).
+
 **4. Restart Claude Desktop** and start optimizing with AI context awareness!
 
 **5. (Optional) Configure custom models** - See [Advanced Model Configuration](#-advanced-model-configuration-optional) below
@@ -469,6 +477,41 @@ mcp-prompt-optimizer version
 4. **Configure** your MCP client with your API key
 5. **Enjoy enhanced optimization** with your chosen models!
 
+## 🔄 Migration to v3.0.0
+
+### ⚠️ Breaking Changes from v2.x
+
+**IMPORTANT:** v3.0.0 includes security enhancements that remove authentication bypasses.
+
+**What Changed:**
+- ❌ `OPTIMIZER_DEV_MODE=true` no longer works
+- ❌ `NODE_ENV=development` no longer enables mock mode
+- ❌ Offline mode has been removed
+- ✅ All API keys must be validated against backend server
+- ✅ Internet connection required (1-2 hour caching for reliability)
+
+**Migration Steps:**
+```bash
+# 1. Ensure you have a valid API key
+export OPTIMIZER_API_KEY="sk-opt-your-key-here"
+
+# 2. Update to v3.0.0
+npm update -g mcp-prompt-optimizer
+
+# 3. Verify it works
+mcp-prompt-optimizer --version  # Should show 3.0.0
+```
+
+**For Developers:**
+- Mock mode removed - use real test API keys from backend database
+- Development keys (`sk-dev-*`) must be real keys, not mocked
+- Offline testing no longer supported - backend connection required
+
+**Cache Behavior:**
+- Primary cache: 1 hour
+- Network failure fallback: Up to 2 hours
+- After 2 hours: Must reconnect to backend
+
 ## 📞 Support & Resources
 
 - **📚 Documentation:** https://promptoptimizer-blog.vercel.app/docs

package/index.js

@@ -16,42 +16,37 @@ const CloudApiKeyManager = require('./lib/api-key-manager');
 const packageJson = require('./package.json');
 
 const API_KEYS_PREFIX = '/api/v1/api-keys';
+const MCP_PREFIX = '/api/v1/mcp';
 
 const ENDPOINTS = {
-  /** Detect AI context (POST)  */
-  DETECT_CONTEXT:      '/api/v1/templates/detect-context',
+  /** Detect AI context (POST) — MCP endpoint, API-key auth */
+  DETECT_CONTEXT:      `${MCP_PREFIX}/detect-context`,
 
-  /** Prompt optimization (POST) */
-  OPTIMIZE:            '/api/v1/optimize',
+  /** Prompt optimization (POST) — MCP endpoint, API-key auth */
+  OPTIMIZE:            `${MCP_PREFIX}/optimize`,
 
-  /** CRUD on templates */
+  /** CRUD on templates — MCP endpoints, API-key auth */
   TEMPLATE: {
     /** Create (POST) */
-    CREATE:            '/api/v1/templates/',
+    CREATE:            `${MCP_PREFIX}/templates`,
 
     /** Read (GET) */
-    GET:               (id) => `/api/v1/templates/${id}`,
+    GET:               (id) => `${MCP_PREFIX}/templates/${id}`,
 
     /** Update (PATCH) */
-    UPDATE:            (id) => `/api/v1/templates/${id}`,
+    UPDATE:            (id) => `${MCP_PREFIX}/templates/${id}`,
 
     /** Delete (DELETE) */
-    DELETE:            (id) => `/api/v1/templates/${id}`,
+    DELETE:            (id) => `${MCP_PREFIX}/templates/${id}`,
   },
 
-  /**
-   * Search templates
-   *  (In the current code‑base this is *not* a dedicated `/search` path –
-   *   the original implementation appends query‑params to `/api/v1/templates/`.
-   *   We keep the original path here so that the existing `handleSearchTemplates`
-   *   handler does not need any change other than using the constant.
-   */
-  SEARCH_TEMPLATES:    '/api/v1/templates/',
+  /** Search templates (GET) — MCP endpoint, API-key auth */
+  SEARCH_TEMPLATES:    `${MCP_PREFIX}/templates`,
 
-  /** Quota status (GET) – note the plural “api‑keys” */
-  QUOTA_STATUS:        `${API_KEYS_PREFIX}/quota-status`,
+  /** Quota status (GET) — MCP endpoint, API-key auth */
+  QUOTA_STATUS:        `${MCP_PREFIX}/quota-status`,
 
-  /** Validate API key (POST) – also under the plural router */
+  /** Validate API key (POST) — standard api-keys router */
   VALIDATE_KEY:        `${API_KEYS_PREFIX}/validate`,
 
   /** Bayesian insights (GET) */
@@ -59,7 +54,7 @@ const ENDPOINTS = {
     '/api/v1/analytics/bayesian-insights',
 
   /** AG‑UI status (GET) */
-  AGUI_STATUS:         '/api/v1/agui/status',
+  AGUI_STATUS:         '/api/status',
 };
 
 class MCPPromptOptimizer {
@@ -78,7 +73,8 @@ class MCPPromptOptimizer {
 
     this.backendUrl = process.env.OPTIMIZER_BACKEND_URL || 'https://p01--project-optimizer--fvmrdk8m9k9j.code.run';
     this.apiKey = process.env.OPTIMIZER_API_KEY;
-    this.developmentMode = process.env.NODE_ENV === 'development' || process.env.OPTIMIZER_DEV_MODE === 'true';
+    // SECURITY: Development mode removed - all environments require backend validation
+    this.developmentMode = false;
     this.requestTimeout = parseInt(process.env.OPTIMIZER_REQUEST_TIMEOUT) || 30000;
     
     // NEW: Feature flags aligned with backend
@@ -392,7 +388,7 @@ class MCPPromptOptimizer {
   async handleOptimizePrompt(args) {
     if (!args.prompt) throw new Error('Prompt is required');
     
-    const manager = new CloudApiKeyManager(this.apiKey, { developmentMode: this.developmentMode });
+    const manager = new CloudApiKeyManager(this.apiKey);
     
     try {
       const validation = await manager.validateApiKey();
@@ -421,25 +417,15 @@ class MCPPromptOptimizer {
       }
 
       // 2. Call the main optimization endpoint
-      const enableBayesian = args.enable_bayesian !== false && this.bayesianOptimizationEnabled;
-      const optimizationPayload = { 
-        prompt: args.prompt, 
-        goals: args.goals || ['clarity'], // Pass original goals, backend will enhance
-        context: {
-          ai_context: detectedContext
-        },
-        enable_bayesian: enableBayesian,
-        metadata: {
-          mcp_version: packageJson.version,
-          feature_flags: {
-            bayesian_optimization: this.bayesianOptimizationEnabled,
-            agui_features: this.aguiFeatures
-          }
-        }
+      const optimizationPayload = {
+        prompt: args.prompt,
+        goals: args.goals || ['clarity'],
+        ai_context: detectedContext,
       };
 
       const result = await this.callBackendAPI(ENDPOINTS.OPTIMIZE, optimizationPayload);
       
+      const enableBayesian = args.enable_bayesian !== false && this.bayesianOptimizationEnabled;
       return { content: [{ type: "text", text: this.formatOptimizationResult(result, { detectedContext, enableBayesian }) }] };
       
     } catch (error) {
@@ -457,7 +443,7 @@ class MCPPromptOptimizer {
   }
 
   async handleGetQuotaStatus() {
-    const manager = new CloudApiKeyManager(this.apiKey, { developmentMode: this.developmentMode });
+    const manager = new CloudApiKeyManager(this.apiKey);
     const info = await manager.getApiKeyInfo();
     return { content: [{ type: "text", text: this.formatQuotaStatus(info) }] };
   }
@@ -602,7 +588,7 @@ class MCPPromptOptimizer {
     };
 
     try {
-        const manager = new CloudApiKeyManager(this.apiKey, { developmentMode: this.developmentMode });
+        const manager = new CloudApiKeyManager(this.apiKey);
         const validation = await manager.validateApiKey();
 
         if (validation.mock_mode || this.developmentMode) {
@@ -1018,7 +1004,8 @@ async function startValidatedMCPServer() {
       process.exit(1);
     }
     
-    const manager = new CloudApiKeyManager(apiKey, { developmentMode: process.env.OPTIMIZER_DEV_MODE === 'true' });
+    // SECURITY: No development mode bypass - backend validation required
+    const manager = new CloudApiKeyManager(apiKey);
     console.log('🔧 Validating API key...\n');
     const validation = await manager.validateAndPrepare();
     

package/lib/api-key-manager.js

@@ -18,11 +18,13 @@ class CloudApiKeyManager {
         this.backendUrl = options.backendUrl || process.env.OPTIMIZER_BACKEND_URL || 'https://p01--project-optimizer--fvmrdk8m9k9j.code.run';
         this.cacheFile = path.join(os.homedir(), '.mcp-cloud-api-cache.json');
         this.healthFile = path.join(os.homedir(), '.mcp-cloud-health.json');
-        this.cacheExpiry = options.cacheExpiry || 24 * 60 * 60 * 1000; // 24 hours
-        this.fallbackCacheExpiry = options.fallbackCacheExpiry || 7 * 24 * 60 * 60 * 1000; // 7 days
+        this.cacheExpiry = options.cacheExpiry || 1 * 60 * 60 * 1000; // 1 hour (reduced from 24)
+        this.fallbackCacheExpiry = options.fallbackCacheExpiry || 2 * 60 * 60 * 1000; // 2 hours (reduced from 7 days)
         this.logPrefix = '[CloudApiKeyManager]';
-        this.offlineMode = options.offlineMode || false;
-        this.developmentMode = options.developmentMode || process.env.NODE_ENV === 'development' || process.env.OPTIMIZER_DEV_MODE === 'true';
+        // SECURITY: Offline mode disabled in production for security
+        this.offlineMode = false;
+        // SECURITY: Development mode disabled - use separate dev builds
+        this.developmentMode = false;
         this.maxRetries = options.maxRetries || 5; // Increased for production
         this.baseRetryDelay = options.baseRetryDelay || 1000;
         this.maxRetryDelay = options.maxRetryDelay || 30000;
@@ -196,12 +198,8 @@ class CloudApiKeyManager {
 
         this.log(`API key format valid: ${formatCheck.keyType}`);
 
-        if (this.developmentMode || formatCheck.keyType === 'testing') {
-            this.log('Development/testing mode detected, using mock validation', 'warn');
-            const mockValidation = this.generateMockValidation(formatCheck.keyType);
-            await this.cacheValidation(mockValidation);
-            return mockValidation;
-        }
+        // SECURITY: Mock validation removed - all keys must validate against backend
+        // Development/testing keys must be real keys in the database
 
         try {
             // Step 3: Backend validation with enhanced retry logic
@@ -229,24 +227,20 @@ class CloudApiKeyManager {
                 return cachedValidation.data;
             }
             
-            // Extended fallback for network issues
+            // SECURITY: Limited fallback for brief network issues only (2 hours max)
             if (cachedValidation && !this.isFallbackCacheExpired(cachedValidation)) {
-                this.log('Using extended fallback cache due to network issues', 'warn');
+                this.log('Using short-term fallback cache due to network issues', 'warn');
                 const fallbackData = cachedValidation.data;
                 fallbackData.fallback_mode = true;
                 fallbackData.network_issue = error.message;
+                fallbackData.expires_soon = true;
                 return fallbackData;
             }
 
-            // If we're in explicit offline mode and have any cache, use it
-            if (this.offlineMode && cachedValidation) {
-                this.log('Offline mode: using cached validation despite expiry', 'warn');
-                const offlineData = cachedValidation.data;
-                offlineData.offline_mode = true;
-                return offlineData;
-            }
+            // SECURITY: Offline mode removed - backend validation required
+            // No cache fallback beyond 2 hours
 
-            throw new Error(`API key validation failed: ${error.message}`);
+            throw new Error(`API key validation failed: ${error.message}. Please check your internet connection.`);
         }
     }
 
@@ -305,8 +299,9 @@ class CloudApiKeyManager {
     // ✅ FIXED: Correct API endpoint URL
     async getQuotaStatus() {
         try {
-            const url = `${this.backendUrl}/api/v1/api-keys/quota-status`;
-            
+            // FIXED: Use MCP quota-status endpoint (accepts API key auth)
+            const url = `${this.backendUrl}/api/v1/mcp/quota-status`;
+
             const options = {
                 method: 'GET',
                 headers: {
@@ -321,16 +316,26 @@ class CloudApiKeyManager {
                 const client = this.backendUrl.startsWith('https://') ? https : http;
                 const req = client.request(url, options, (res) => {
                     let data = '';
-                    
+
                     res.on('data', (chunk) => {
                         data += chunk;
                     });
-                    
+
                     res.on('end', () => {
                         try {
                             if (res.statusCode === 200) {
-                                const result = JSON.parse(data);
-                                resolve(result);
+                                const response = JSON.parse(data);
+                                // FIXED: Map nested MCP response to flat format
+                                resolve({
+                                    tier: response.tier,
+                                    unlimited: response.quota?.unlimited || false,
+                                    used: response.quota?.used || 0,
+                                    remaining: response.quota?.remaining || 0,
+                                    limit: response.quota?.limit,
+                                    usage_percentage: response.quota?.percentage || 0,
+                                    status: response.quota?.status || 'unknown',
+                                    features_available: response.features_available || {}
+                                });
                             } else {
                                 let errorMessage;
                                 try {
@@ -520,41 +525,15 @@ class CloudApiKeyManager {
         }
     }
 
-    // Enhanced API key info with mode detection
+    // Enhanced API key info with backend validation
     async getApiKeyInfo() {
         const formatCheck = this.validateApiKeyFormat(this.apiKey);
-        if (this.developmentMode || formatCheck.keyType === 'development' || formatCheck.keyType === 'testing') {
-            this.log('Development/testing mode detected for getApiKeyInfo, returning mock data.', 'warn');
-            return {
-                tier: 'testing',
-                features: {
-                    optimization: true,
-                    template_search: true,
-                    template_auto_save: true,
-                    optimization_insights: true,
-                    bayesian_optimization: true,
-                    agui_features: true
-                },
-                quota: {
-                    unlimited: false,
-                    used: Math.floor(Math.random() * 100),
-                    limit: 1000,
-                    remaining: 1000 - Math.floor(Math.random() * 100)
-                },
-                isValid: true,
-                keyType: formatCheck.keyType,
-                mode: {
-                    mock: true,
-                    fallback: false,
-                    offline: false,
-                    development: this.developmentMode
-                }
-            };
-        }
+
+        // SECURITY: Mock data removed - all keys must validate with backend
 
         try {
-            // Directly call the new quota-status endpoint
-            const quotaStatusResponse = await this._makeBackendRequest('/api/v1/api-keys/quota-status', null, 'GET');
+            // FIXED: Use MCP quota-status endpoint (accepts API key auth)
+            const quotaStatusResponse = await this._makeBackendRequest('/api/v1/mcp/quota-status', null, 'GET');
             
             // The backend /mcp/quota-status endpoint returns a comprehensive object
             // that includes tier, quota details, and features.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-prompt-optimizer",
-  "version": "2.2.3",
+  "version": "3.0.2",
   "description": "Professional cloud-based MCP server for AI-powered prompt optimization with intelligent context detection, Bayesian optimization, AG-UI real-time optimization, template auto-save, optimization insights, personal model configuration via WebUI, team collaboration, enterprise-grade features, production resilience, and startup validation. Universal compatibility with Claude Desktop, Cursor, Windsurf, and 17+ MCP clients.",
   "main": "index.js",
   "bin": {