meguro-mcp 0.2.10 → 0.2.12

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 All notable changes to `meguro-mcp` are recorded here. Versions follow Semantic Versioning.
 
+## 0.2.12 — 2026-08-11
+
+- Adds a credential-safe, state-aware `adminExecutionGuide` to `get_connection_details`, separating
+  hosted OAuth/public STDIO control-plane authentication from the per-store Admin data plane.
+- Adds authority-derived `admin_schema` execution requirements for run state, the exact inventory
+  read-before-write cursor, valid next calls, and the two-root `@idempotent` contract.
+- Adds immutable getting-started v13, product-guide v10, and documentation-index v9 resources while
+  preserving every prior documentation byte and digest. This is a prepared package candidate only;
+  it is not published or deployed.
+
+## 0.2.11 — 2026-08-11
+
+- Adds registry-derived `admin_recipes_list` discovery without exposing tenant or store data or
+  executing Admin probes.
+- Adds bounded authored-alias teaching for recipe misses and schema-authority-derived root-type
+  recovery while preserving exact successful `admin_schema` lookup behavior.
+- Adds immutable getting-started v12 and documentation-index v8 resources for the discovery path;
+  every prior documentation resource remains byte-identical.
+
 ## 0.2.10 — 2026-08-10
 
 - Adds immutable getting-started v8, product-guide v5, and documentation-index v4 resources that

package/README.md

@@ -21,12 +21,12 @@ The configured hosted endpoints are environment-specific: dev uses
 `https://mcp-dev.meguro.io/mcp`, stage uses `https://mcp-stage.meguro.io/mcp`, and production uses
 `https://mcp.meguro.io/mcp`. Use the URL shown by the Console for the environment you intend to access.
 
-After connecting, read `meguro://docs/getting-started/v6` for the world-first operating sequence;
-for general Meguro questions, read `meguro://docs/product-guide/v3`. Both are available through
+After connecting, read `meguro://docs/getting-started/v13` for the world-first operating sequence;
+for general Meguro questions, read `meguro://docs/product-guide/v10`. Both are available through
 `resources/read` or the matching `docs_read({ topic, version })` fallback.
 
-The hosted server exposes 44 customer-safe tools and deliberately excludes `admin_probe` and
-`admin_schema`. Active grants are visible and revocable under Console → Settings → Connection → MCP
+The hosted server exposes 39 customer-safe tools and deliberately excludes `admin_probe`. Active
+grants are visible and revocable under Console → Settings → Connection → MCP
 authorizations.
 
 ## Transport boundaries
@@ -43,7 +43,7 @@ Console provides fast trusted proof and evidence inspection; the agency agent no
 
 <!-- BEGIN GENERATED MCP TOOL TABLE -->
 <!-- Run `npm run docs:tools --workspace meguro-mcp` to refresh this section from `tools/list`. -->
-This table is generated from the server's live `tools/list` response (47 tools).
+This table is generated from the server's live `tools/list` response (48 tools).
 
 | Tool | Title | Behavior annotations |
 |---|---|---|
@@ -94,6 +94,7 @@ This table is generated from the server's live `tools/list` response (47 tools).
 | `get_connection_details` | Get practice-store connection details | read-only · non-destructive · idempotent · closed-world |
 | `admin_probe` | Run an Admin API probe | read-write · non-destructive · non-idempotent · closed-world |
 | `admin_schema` | Look up the Admin API schema | read-only · non-destructive · idempotent · closed-world |
+| `admin_recipes_list` | List Admin API recipes | read-only · non-destructive · idempotent · closed-world |
 <!-- END GENERATED MCP TOOL TABLE -->
 
 ## Documentation resources
@@ -160,7 +161,7 @@ Use these tool names in order:
 
 1. `templates_list()` to discover the supported template keys.
 2. `stores_list()`, then reuse an owned store or call `store_create({ templateKey })`.
-3. `get_connection_details({ storeId })` through the explicit secure flow (`worldId` remains a legacy alias). Keep the returned values out of model/chat logs.
+3. `get_connection_details({ storeId })` through the explicit secure flow (`worldId` remains a legacy alias). Follow its structured `adminExecutionGuide`; keep returned credential values out of model/chat logs.
 4. `practice_run_start({ storeId, clock: { mode: "harness", simulationDays: 14, stepDays: 1 } })` — the same `storeId` the previous step took and returned.
 5. Launch the agency agent in its own environment with the stable returned `SHOPIFY_*` values.
 6. `practice_run_status({ attemptId })`, then `practice_run_checkpoint({ attemptId })`.
@@ -173,6 +174,12 @@ data-plane credential your commerce agent needs for the exact returned `*.meguro
 it as a secret, provide it only to that agent process, and keep it out of model/chat logs. It is not the
 account-scoped `MEGURO_API_TOKEN` and cannot control other stores or account resources.
 
+Hosted OAuth and the public package's `MEGURO_API_TOKEN` authenticate MCP/control-plane calls only.
+Admin GraphQL calls use the returned Admin URL and the per-store token in
+`X-Shopify-Access-Token`; never send the OAuth bearer to the Admin URL. Before one bounded write,
+read `admin_schema`'s `match.executionRequirements` for the required run state, any exact preflight
+read, valid next calls, and the authority-derived idempotency example.
+
 `manual`, `harness`, and `scheduled` are clock ownership modes. Raw Admin GraphQL requests do not each
 advance time. Practice-run status, checkpoint, and receipt responses deliberately exclude raw private
 evidence and credentials; `get_connection_details` is the one explicit credential-returning tool.
@@ -192,7 +199,7 @@ OAuth support. It requires a workspace-bound `meg_sk_…` API key and exposes th
 surface. Pin the exact public version in client configuration so a quickstart stays reproducible:
 
 ```bash
-npx -y meguro-mcp@0.2.10
+npx -y meguro-mcp@0.2.12
 ```
 
 ### Environment
@@ -210,7 +217,7 @@ claude mcp add meguro \
   -e MEGURO_API_BASE_URL=https://api-dev.meguro.io \
   -e MEGURO_API_TOKEN=meg_sk_... \
   -e MEGURO_DASHBOARD_URL=https://... \
-  -- npx -y meguro-mcp@0.2.10
+  -- npx -y meguro-mcp@0.2.12
 ```
 
 ### Register — Cursor (`.cursor/mcp.json`)
@@ -220,7 +227,7 @@ claude mcp add meguro \
   "mcpServers": {
     "meguro": {
       "command": "npx",
-      "args": ["-y", "meguro-mcp@0.2.10"],
+      "args": ["-y", "meguro-mcp@0.2.12"],
       "env": {
         "MEGURO_API_BASE_URL": "https://api-dev.meguro.io",
         "MEGURO_API_TOKEN": "meg_sk_...",
@@ -241,6 +248,6 @@ npm test --workspace meguro-mcp
 ```
 
 The test suite packs the public artifact, installs it into a temporary clean-room project, starts the
-installed binary, and requires `tools/list` to return exactly 46 tools without leaking supplied
+installed binary, and requires `tools/list` to return exactly 48 tools without leaking supplied
 credentials to stdout or stderr. Maintainers should follow [RELEASING.md](./RELEASING.md) for every
 version; release notes are in [CHANGELOG.md](./CHANGELOG.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "meguro-mcp",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "private": false,
   "type": "module",
   "description": "Meguro control-plane MCP server: drive worlds, runs, and verdicts from your own AI tools.",