ourpr-mcp-server 0.2.0 → 0.3.0

package/README.md

@@ -1,10 +1,12 @@
 # ourpr-mcp-server
 
 An MCP server that lets an AI agent read **your own** running history from
-[ourpr](https://ourpr.app). Ask about your training in plain language, in
-whatever agent you already use.
+[ourpr](https://ourpr.app), and write one thing back. Ask about your
+training in plain language, in whatever agent you already use.
 
-Read only. It cannot change a run, plan a week, or issue another credential.
+Every tool reads. One tool writes, and only that one: `ourpr_plan_week` puts
+a plan on a day still ahead. It cannot log a run, edit history, or issue
+another credential, and it needs a token made with the write scope.
 
 ## Why it exists
 
@@ -15,9 +17,11 @@ credential you issued to yourself and can revoke.
 
 ## Setup
 
-**1. Make a token.** In ourpr, go to **Settings → Access tokens → New token**.
-Name it after the machine it will live on. Copy it — it is shown once and
-cannot be recovered. A token lasts 90 days.
+**1. Make a token.** In ourpr, go to
+**Profile → Settings → ourpr. mcp → New token**. Name it after the machine it
+will live on, and choose **Write** if you want the agent to plan your week;
+**Read** otherwise. Copy it — it is shown once and cannot be
+recovered. A token lasts 90 days.
 
 **2. Point a client at it.** The package runs from npm; nothing to clone.
 
@@ -132,6 +136,24 @@ done that resembles a race you are training for.
 "What have I run that's like Boston — 26 miles, 800 feet of climb?"
 ```
 
+### `ourpr_plan_week`
+
+The one write. One planned run, or a week of them, onto days still ahead.
+Each lands on the runner's week as a plan they can see, edit and remove; the
+day sheet says it came from ourpr create. It never logs a run.
+
+```
+"Put a 6 mile easy run on Tuesday and 14 long on Saturday"
+"Write me next week: three easy days, one workout, one long run"
+```
+
+`plans`, one to fourteen, each with `date` (YYYY-MM-DD, after today) and any
+of `miles`, `minutes`, `name`, `note`, `tag` (easy, workout, race), `is_long`.
+
+Needs a token made with the **Write** scope, and ourpr create on the account.
+A **Read** token, or an account without create, is refused before anything is
+written. Thirty plans a day.
+
 ## How the tool set was chosen
 
 By an evaluation, not by listing the API.
@@ -166,15 +188,17 @@ numbers the agent would only reduce anyway.
 
 ## Security
 
-The token grants read access to your own activity data and nothing else. It
-cannot write, cannot issue another token, cannot revoke your existing ones, and
-cannot widen its own scope.
+The token grants read access to your own activity data. A token made with the
+write scope, with ourpr create, may also put plans on your own week through
+one route, and nothing else. No token can log a run, issue another token, revoke
+your existing ones, or widen its own scope.
 
-Each token may make 60 reads a minute. ourpr answers 429 past that, with
-`RateLimit` and `Retry-After` headers, and the tool says how long to wait.
+Each token may make 60 reads a minute, and a runner may write 30 plans a day.
+ourpr answers 429 past either, with `RateLimit` and `Retry-After` headers, and
+the tool says how long to wait.
 
-Revoke any token at any time in **Settings → Access tokens**. Revocation is
-immediate and permanent — a revoked token can never be restored.
+Revoke any token at any time in **Profile → Settings → ourpr. mcp**.
+Revocation is immediate and permanent — a revoked token can never be restored.
 
 ### Tool results are untrusted content
 
@@ -241,6 +265,11 @@ bundle's entry point; `npx @anthropic-ai/mcpb pack` builds `ourpr.mcpb` for
 the release. `server.json` registers the package in the MCP Registry with
 `mcp-publisher publish`.
 
+The tag run answers npm's `E404` on the PUT until the package lists this
+repository and `publish.yml` as a trusted publisher on npmjs.com (package
+settings, Trusted publisher). Until then the release is by hand: `npm login`,
+then `npm publish` from this directory, which builds and tests first.
+
 ## License
 
 MIT

package/build/api.js

@@ -1,42 +1,12 @@
-// The ourpr API, as this server talks to it.
-//
-// AUTHENTICATION IS AN ENVIRONMENT VARIABLE, NOT A TOOL PARAMETER, and that is
-// a deliberate difference from revenuecat-charts-mcp, which takes `api_key` on
-// every call. RevenueCat issues one key per project and a person may hold
-// several, so asking per call is right there. An ourpr token belongs to ONE
-// runner and never changes between calls, so a parameter would put a live
-// credential into every tool call the agent makes — into its context, its
-// transcript, and any log of either. The env var keeps it out of all three.
-//
-// NOTHING THIS SERVER PRINTS MAY CARRY A CONFIGURED VALUE. `OURPR_TOKEN` is
-// never printed anywhere, and `OURPR_API_URL` is reduced to scheme and host
-// before it reaches an error — see `safeOrigin`. An error message travels into
-// the agent's context and its transcript, so printing there is publishing.
-//
-// NOTHING HERE MAY WRITE TO STDOUT. On a stdio server stdout IS the protocol
-// stream, and one stray `console.log` corrupts it. Diagnostics go to stderr.
+// The token is an environment variable, never a tool parameter, so no call carries it.
 import { cell } from "./safe.js";
 const TOKEN = process.env.OURPR_TOKEN ?? "";
 const BASE = (process.env.OURPR_API_URL ?? "https://ourpr.onrender.com/api").replace(/\/$/, "");
-// A bearer token over plain http travels in the clear. Warn once rather than
-// refuse: localhost is how this server runs against a dev backend.
+// A token over plain http travels in the clear; localhost is the dev backend.
 if (BASE.startsWith("http://") && !/^http:\/\/(localhost|127\.0\.0\.1)[:/]/.test(BASE)) {
     console.error("[ourpr-mcp-server] OURPR_API_URL is http, not https - the token is not encrypted in transit");
 }
-/**
- * The configured host, with everything else removed.
- *
- * NO ENVIRONMENT VALUE IS ECHOED WHOLE. An error goes straight into the
- * agent's context and its transcript, so anything printed there is published.
- * `OURPR_API_URL` is usually just a hostname — and it is a URL, so it CAN
- * carry `user:password@` before the host, which a self-hosted or staging
- * instance behind basic auth plausibly would. Dropping userinfo, path, query
- * and fragment leaves the one part that helps a person debug and none of the
- * part that must not travel.
- *
- * An unparseable value yields a placeholder rather than the raw string,
- * because "unparseable" is exactly the case where the string is unexpected.
- */
+/** The configured host only; userinfo, path and query never reach an error. */
 function safeOrigin() {
     try {
         const url = new URL(BASE);
@@ -46,19 +16,9 @@ function safeOrigin() {
         return "the configured host";
     }
 }
-/**
- * Why a request failed, WITHOUT the message.
- *
- * A Node fetch failure carries the full request URL in `cause`, and a timeout
- * message can too. The code — ECONNREFUSED, ENOTFOUND, TimeoutError — says
- * everything a person needs and carries nothing they did not choose to
- * publish.
- */
+/** The error code, never the message, which can carry the request URL. */
 function reason(err) {
-    // WALK THE CAUSE CHAIN. Node wraps a connection failure as
-    // `TypeError: fetch failed` with the useful code — ECONNREFUSED, ENOTFOUND —
-    // one or two levels down in `cause`. Reading only the top gave "TypeError",
-    // which tells a person nothing they can act on.
+    // Node puts the useful code one or two levels down in cause.
     let node = err;
     for (let depth = 0; node && depth < 4; depth++) {
         const code = node.code;
@@ -66,10 +26,7 @@ function reason(err) {
             return code;
         node = node.cause;
     }
-    // NO CODE — a URL that will not parse ("bad port") reaches here, and its
-    // MESSAGE is the only useful thing. Passed on ONLY when it cannot be
-    // carrying configured values: an "@" means userinfo, and the raw base or the
-    // token must never appear. Fails closed to the error name.
+    // A message passes only when it cannot carry a configured value.
     const deepest = deepestMessage(err);
     const safe = deepest &&
         !deepest.includes("@") &&
@@ -98,15 +55,18 @@ export class ApiError extends Error {
 function guidance(status, detail, retryAfterS) {
     if (status === 429) {
         const wait = /^\d+$/.test(retryAfterS ?? "") ? `${retryAfterS} seconds` : "a minute";
-        return `ourpr allows 60 reads a minute for each token. Wait ${wait}, then ask again.`;
+        return ("ourpr allows 60 reads a minute for each token and 30 plans a day. " +
+            `Wait ${wait}, then ask again.`);
     }
     if (status === 401) {
         return ("ourpr rejected the token. It may be revoked, expired (a token lasts 90 " +
             "days), or OURPR_TOKEN may be unset. Make a new one in ourpr under " +
-            "Settings, Access tokens.");
+            "Profile, Settings, ourpr. mcp.");
+    }
+    if (status === 403) {
+        return ("ourpr refused the write. The token needs the write scope, chosen when " +
+            "it is made, and ourpr create behind it.");
     }
-    if (status === 403)
-        return "That token can read only. This action needs a write scope.";
     if (status === 404)
         return "ourpr has no such run. Check the id against ourpr_list_runs.";
     if (status === 422)
@@ -115,33 +75,27 @@ function guidance(status, detail, retryAfterS) {
         return "ourpr had an error. Try again in a moment.";
     return detail || `ourpr answered ${status}.`;
 }
-/**
- * One line per call, on stderr.
- *
- * The 2026 guidance asks a server to log tool invocations, downstream calls,
- * errors and denials, so an operator can see what an agent did on their
- * behalf. THE PATH IS LOGGED AND THE TOKEN NEVER IS — a log that carries the
- * credential is a second copy of it, in a file nobody is guarding.
- */
+// The path is logged and the token never is.
 function audit(path, outcome, ms) {
     console.error(`[ourpr-mcp-server] ${outcome} ${path.split("?")[0]} ${ms}ms`);
 }
-export async function get(path) {
+async function request(method, path, payload) {
     const started = Date.now();
     if (!TOKEN) {
-        throw new ApiError("OURPR_TOKEN is not set. Create a token in ourpr under Settings, " +
-            "Access tokens, then put it in this server's environment.");
+        throw new ApiError("OURPR_TOKEN is not set. Create a token in ourpr under Profile, " +
+            "Settings, ourpr. mcp, then put it in this server's environment.");
     }
     let response;
     try {
         response = await fetch(`${BASE}${path}`, {
-            headers: { Authorization: `Bearer ${TOKEN}` },
+            method,
+            headers: {
+                Authorization: `Bearer ${TOKEN}`,
+                ...(payload === undefined ? {} : { "Content-Type": "application/json" }),
+            },
+            body: payload === undefined ? undefined : JSON.stringify(payload),
             signal: AbortSignal.timeout(60_000),
-            // DO NOT FOLLOW REDIRECTS WITH A CREDENTIAL ATTACHED. Node strips the
-            // Authorization header across origins, so this is belt rather than
-            // braces — but a redirect from ourpr's own host is not something this
-            // server should follow silently either, because the answer would then
-            // come from somewhere the operator did not configure.
+            // A request that carries the token never follows a redirect.
             redirect: "manual",
         });
     }
@@ -149,10 +103,7 @@ export async function get(path) {
         throw new ApiError(`Could not reach ourpr at ${safeOrigin()} (${reason(err)}). Check ` +
             "OURPR_API_URL and the network.");
     }
-    // OUTSIDE THE TRY, deliberately. Thrown inside it, this was caught by the
-    // network handler two lines up and re-reported as "could not reach ourpr" —
-    // an error that names the wrong cause is worse than the status code it
-    // replaced.
+    // Outside the try, so a redirect is not reported as a network failure.
     if (response.status >= 300 && response.status < 400) {
         audit(path, `${response.status}-redirect`, Date.now() - started);
         throw new ApiError("ourpr redirected the request, and this server does not follow " +
@@ -162,13 +113,11 @@ export async function get(path) {
     if (!response.ok) {
         let detail = "";
         try {
-            // CLEANED LIKE ANY OTHER REMOTE TEXT. Today `detail` is written by the
-            // backend, but a future backend change could derive it from runner
-            // text, and this is the one place it enters an error message.
+            // detail is remote text and is cleaned like any other.
             detail = cell((await response.json()).detail, 200);
         }
         catch {
-            // A non-JSON error body. The status still carries the meaning.
+            // The status carries the meaning without a body.
         }
         audit(path, `${response.status}`, Date.now() - started);
         throw new ApiError(guidance(response.status, detail, response.headers.get("retry-after") ?? undefined));
@@ -178,9 +127,7 @@ export async function get(path) {
         body = (await response.json());
     }
     catch {
-        // A 200 whose body is not JSON - a proxy page, a captive portal. The
-        // parse error's message can carry a fragment of that body, so the error
-        // is replaced rather than passed on.
+        // A non-JSON body can leak into the parse error, so the error is replaced.
         audit(path, "200-not-json", Date.now() - started);
         throw new ApiError(`ourpr at ${safeOrigin()} answered 200 with a body that is not JSON. ` +
             "Check OURPR_API_URL - it should be the API base, ending in /api.");
@@ -188,19 +135,11 @@ export async function get(path) {
     audit(path, "200", Date.now() - started);
     return body;
 }
-// ─── Units ──────────────────────────────────────────────────────────────────
-//
-// The API speaks metres and stores pace as a string, "7:43". An agent reads
-// miles and reasons about pace as text. Convert once, here, so no tool does it
-// twice and no two tools do it differently.
-/**
- * An id on its way into a URL path.
- *
- * Ids arrive from the agent, and an agent can be steered by text inside a
- * tool result. Unencoded, a crafted id could append query parameters or move
- * the request to a sibling path - fetch normalises "../" before sending.
- * Encoding makes the id one path segment and nothing more.
- */
+export const get = (path) => request("GET", path);
+/** The one write. The route it reaches needs the write scope and ourpr create. */
+export const post = (path, body) => request("POST", path, body);
+// Units: the API speaks metres and an agent reads miles. Convert once, here.
+/** Encoded, so a crafted id stays one path segment. */
 export const pathId = (value) => encodeURIComponent(value);
 export const METERS_PER_MILE = 1609.344;
 export const miles = (meters) => meters == null ? null : Math.round((meters / METERS_PER_MILE) * 100) / 100;
@@ -215,14 +154,7 @@ export function duration(seconds) {
 }
 /** A day key, YYYY-MM-DD, out of whatever the API stored. */
 export const day = (iso) => (iso ?? "").slice(0, 10);
-/**
- * A calendar date to the Unix second the API wants.
- *
- * TOOLS TAKE DATES AND THE API TAKES TIMESTAMPS. An agent is asked "what did I
- * run in July", not "what did I run between 1751328000 and 1754006400", and
- * making it do that arithmetic is a step where it can quietly be wrong.
- * `end` pushes to the end of the day so a single-day window holds that day.
- */
+/** A calendar date to a Unix second; "end" reaches the end of the day. */
 export function stamp(date, edge) {
     const time = edge === "start" ? "T00:00:00Z" : "T23:59:59Z";
     const ms = Date.parse(`${date}${time}`);

package/build/index.js

@@ -2,60 +2,26 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { ApiError, day, duration, feet, get, miles, pathId, stamp } from "./api.js";
+import { ApiError, METERS_PER_MILE, day, duration, feet, get, miles, pathId, post, stamp, } from "./api.js";
 import { cell, fenced } from "./safe.js";
-/**
- * ourpr-mcp-server — an agent reads your own running history.
- *
- * WHY THIS EXISTS. Every authenticated read in ourpr is gated by a session
- * that lives about an hour, so nothing outside a browser could hold one.
- * Personal access tokens changed that, and this is what they were for: your
- * training data, in whatever agent you already use, with a credential you
- * issued to yourself and can revoke.
- *
- * READ ONLY, and not by omission. A token's default scope is read, and every
- * route behind these tools is a GET. Nothing here can change a run, plan a
- * week, or mint another token.
- *
- * THE TOOL SET WAS CHOSEN BY AN EVALUATION, not by listing the API. Ten
- * verified questions were written first (`backend/scripts/mcp_eval_oracle.py`)
- * and they said what matters: nine of ten need the activity window, three need
- * one run in full, two need a second source. So the window is the tool that
- * has to be excellent, and a `training_summary` tool that seemed obvious when
- * guessing turned out to answer nothing and was not built.
- *
- * CONTEXT IS THE REAL CONSTRAINT. A window can hold 800 runs, and handing an
- * agent 800 full activity objects destroys the context it needs to think. So
- * `ourpr_list_runs` returns a COMPACT table and one run in full is a separate
- * tool. That is the same lesson the backend learned when `laps` turned out to
- * be 36% of a payload nothing rendered — an agent's context is more expensive
- * than egress, not less.
- */
-/** The watch or app that recorded a run, as one readable name.
- *
- *  `device` is an OBJECT and its keys vary — measured across all 7,911
- *  production rows: {make,model,raw} 2,064, {app,raw} 718, {app,make,model}
- *  684, {make,raw} 373, {model,raw} 81, and 3,986 null. So prefer the human
- *  pair, fall back to whichever single name exists, and only then to `raw`,
- *  which is a slug like "garmin/fr255" and is the last resort rather than the
- *  answer. */
+// Seven reads and one write. The write needs a token made with the write
+// scope and ourpr create behind it; every other tool is a GET.
+// device keys vary: the human pair first, then a single name, then the raw slug.
 function deviceLabel(d) {
     if (!d)
         return null;
     const named = [d.make, d.model].filter(Boolean).join(" ").trim();
     return cell(named || d.app || d.raw, 40) || null;
 }
-const server = new McpServer({ name: "ourpr-mcp-server", version: "0.1.0" });
-// A window can hold years. This bounds ONE answer, and when it bites the
-// answer says so — a silent truncation reads as "that is all there was",
-// which is the difference between a short answer and a wrong one.
+const server = new McpServer({ name: "ourpr-mcp-server", version: "0.3.0" });
+// Bounds one answer; when it bites, the answer says so.
 const DEFAULT_LIMIT = 100;
 const MAX_LIMIT = 500;
 const ok = (text, structured) => ({
     content: [{ type: "text", text }],
     structuredContent: structured,
 });
-/** Errors reach the agent as an error result with copy it can act on. */
+// An error reaches the agent as an error result with copy it can act on.
 const fail = (err) => ({
     content: [
         {
@@ -65,12 +31,10 @@ const fail = (err) => ({
     ],
     isError: true,
 });
-/** One activity, flattened to what an agent reasons about. */
 function summarise(a) {
     return {
         id: String(a.id),
         date: day(a.date),
-        // RUNNER-AUTHORED TEXT. Cleaned at the one boundary it crosses.
         name: cell(a.name),
         type: cell(a.activity_type, 24),
         miles: miles(a.distance_meters),
@@ -80,8 +44,7 @@ function summarise(a) {
         avg_hr: a.avg_heartrate ?? null,
     };
 }
-/** A markdown table. Agents read these far more reliably than raw JSON, and
- *  it costs a fraction of the tokens the same rows cost as objects. */
+// A markdown table costs fewer tokens than the same rows as objects.
 function table(rows) {
     const head = "| date | name | type | mi | pace | time | ft | hr |\n" +
         "|---|---|---|---|---|---|---|---|";
@@ -217,9 +180,7 @@ server.registerTool("ourpr_run_stream", {
 }, async ({ activity_id }) => {
     try {
         const s = await get(`/users/me/activities/${pathId(activity_id)}/stream`);
-        // SUMMARY AND NOT THE SAMPLES. A 10 mile run is ~1,600 points per
-        // channel and five channels. Handing an agent 8,000 numbers spends its
-        // context on data it will only reduce anyway.
+        // A summary, not the samples: a 10 mile run is about 8,000 numbers.
         const stats = (values, scale = 1) => {
             const nums = (values ?? []).filter((v) => v != null);
             if (!nums.length)
@@ -233,7 +194,7 @@ server.registerTool("ourpr_run_stream", {
             };
         };
         const channels = {
-            // Stored in centimetres; feet is what the app speaks.
+            // Stored in centimetres; the app speaks feet.
             elevation_ft: stats(s.elev_cm, 0.0328084),
             heart_rate_bpm: stats(s.hr_bpm),
             power_w: stats(s.power_w),
@@ -268,15 +229,11 @@ server.registerTool("ourpr_run_laps", {
         const raw = await get(`/users/me/activities/${pathId(activity_id)}/laps`);
         const laps = raw.map((l, i) => {
             const mi = miles(l.distance_meters);
-            // THE PACE IS DERIVED HERE, because the payload does not carry one.
-            // Moving seconds, not elapsed: standing at the line between reps is
-            // not part of the rep, and the whole app measures pace this way.
+            // The payload carries no pace; moving seconds, as the app measures it.
             const secs = l.moving_seconds ?? l.duration_seconds ?? null;
             const perMile = mi && secs ? secs / mi : null;
             return {
-                // THE API COUNTS FROM ZERO AND A RUNNER COUNTS FROM ONE. A watch
-                // says "Lap 1" on the first press, so a table headed lap 0 is
-                // describing a different session from the one they remember.
+                // The API counts from zero; a watch counts from one.
                 lap: (l.index ?? i) + 1,
                 miles: mi,
                 time: duration(secs),
@@ -328,8 +285,7 @@ server.registerTool("ourpr_rep_workouts", {
                 times_s: g.times_s ?? null,
             })),
         }));
-        // AN EMPTY ANSWER SAYS WHAT WAS READ. "None found" and "none exist" are
-        // different claims, and only the first one is true here.
+        // "None found" and "none exist" differ; only the first is true here.
         const text = workouts.length
             ? `${workouts.length} rep sessions in the ${data.scanned} activities read.\n\n` +
                 workouts
@@ -356,8 +312,7 @@ server.registerTool("ourpr_detect_reps", {
 }, async ({ activity_id }) => {
     try {
         const detection = await get(`/users/me/activities/${pathId(activity_id)}/workout-detection`);
-        // BOUNDED. This was an unbounded pretty-printed dump, which is the one
-        // shape that can spend an agent's context without anyone choosing to.
+        // Bounded, so a dump cannot spend the agent's context.
         const json = JSON.stringify(detection);
         return ok(json.length > 4000
             ? `${json.slice(0, 4000)}… (truncated; read the structured result)`
@@ -409,11 +364,72 @@ server.registerTool("ourpr_similar_terrain", {
         return fail(err);
     }
 });
+// ─── The week ───────────────────────────────────────────────────────────────
+const PLAN_TAGS = ["easy", "workout", "race"];
+server.registerTool("ourpr_plan_week", {
+    title: "Put runs on the runner's week",
+    description: "Write one planned run, or a week of them, onto days still ahead. Each " +
+        "lands on the runner's week as a plan they can see, edit and remove. " +
+        "Needs a token made with the write scope and ourpr create. " +
+        "Never logs a run.",
+    inputSchema: {
+        plans: z
+            .array(z.object({
+            date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/).describe("YYYY-MM-DD, after today."),
+            miles: z.number().min(0.1).max(200).optional().describe("Planned distance."),
+            minutes: z.number().min(1).max(1440).optional().describe("Planned time."),
+            name: z.string().max(120).optional().describe("A short name for the run."),
+            note: z.string().max(500).optional().describe("A line the runner will read."),
+            tag: z.enum(PLAN_TAGS).optional().describe("How hard: easy, workout or race."),
+            is_long: z.boolean().optional().describe("The week's long run."),
+        }))
+            .min(1)
+            .max(14)
+            .describe("One run, or up to fourteen."),
+    },
+    outputSchema: {
+        written: z.array(z.record(z.string(), z.unknown())),
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false },
+}, async ({ plans }) => {
+    try {
+        const body = {
+            plans: plans.map((p) => ({
+                planned_date: p.date,
+                distance_meters: p.miles == null ? null : Math.round(p.miles * METERS_PER_MILE),
+                duration_seconds: p.minutes == null ? null : Math.round(p.minutes * 60),
+                name: p.name ?? null,
+                note: p.note ?? null,
+                tag: p.tag ?? null,
+                is_long: p.is_long ?? false,
+            })),
+        };
+        const rows = await post("/users/me/planned-activities/week", body);
+        const written = rows.map((r) => ({
+            id: String(r.id),
+            date: day(r.planned_date),
+            name: cell(r.name),
+            miles: miles(r.distance_meters),
+            time: duration(r.duration_seconds),
+            tag: r.tag ?? null,
+            is_long: r.is_long,
+        }));
+        const text = `${written.length} plan${written.length === 1 ? "" : "s"} on the runner's week.\n\n` +
+            "| date | name | mi | time | tag |\n|---|---|---|---|---|\n" +
+            written
+                .map((w) => `| ${w.date} | ${w.name || "—"} | ${w.miles ?? "—"} | ${w.time ?? "—"} | ` +
+                `${w.tag ?? "—"}${w.is_long ? " · long" : ""} |`)
+                .join("\n");
+        return ok(text, { written });
+    }
+    catch (err) {
+        return fail(err);
+    }
+});
 // ─── Start ──────────────────────────────────────────────────────────────────
 async function main() {
     await server.connect(new StdioServerTransport());
-    // STDERR, ALWAYS. On a stdio server stdout is the protocol stream and one
-    // `console.log` corrupts it.
+    // Stdout is the protocol stream; diagnostics go to stderr.
     console.error("[ourpr-mcp-server] ready");
 }
 main().catch((err) => {

package/build/safe.js

@@ -1,84 +1,32 @@
-// Runner-authored text, on its way into an agent's context.
-//
-// EVERY TOOL RESULT HERE IS UNTRUSTED CONTENT. A run's name and description
-// are free text a person typed, or that arrived from a Strava or Garmin
-// import. They travel verbatim into the same token stream as the agent's
-// instructions, and a model has no hardware boundary between the two. That is
-// the whole of the prompt-injection problem and no library fixes it.
-//
-// Two defences, and they do different jobs.
-//
-// 1. NEUTRALISE THE STRUCTURE. A `|` or a newline in a name corrupts the
-//    markdown table it lands in — an agent then reads columns that shifted,
-//    which is a wrong answer rather than a refused one. Measured against
-//    1,000 of Joey's activities: zero names carry one today, the longest name
-//    is 86 characters, and 400 runs carry a description up to 362. Nothing
-//    prevents the next one. This is a correctness fix that happens to close an
-//    injection surface.
-//
-// 2. NAME THE BOUNDARY. Wrapping the data in explicit delimiters and saying
-//    once that what is inside is data does not solve injection. It measurably
-//    reduces how often it lands, which is the honest claim for it, and it
-//    costs one line per response rather than a preamble on every field.
-//
-// What this deliberately does NOT do is pattern-match for "ignore previous
-// instructions" and friends. That is whack-a-mole against an attacker who
-// writes one sentence differently, and it would give a false sense that the
-// content had been made safe.
-/** The longest a name may be before it is cut. Long enough for every real one
- *  measured (86), short enough that a pasted paragraph cannot flood a row. */
+// Runner-authored text is untrusted; it is neutralised, never pattern-matched.
+// Longer than any measured name, shorter than a pasted paragraph.
 const MAX_NAME = 90;
-/** A description is prose and belongs on a single run, never in a table. */
+// A description belongs on one run, never in a table.
 const MAX_NOTE = 300;
-/**
- * One field of runner-authored text, made safe to put in a table cell.
- *
- * Control characters and newlines become spaces, a pipe is escaped so the
- * column it sits in survives, and the whole thing is capped.
- */
+/** One field of runner text, made safe for a table cell. */
 export function cell(value, max = MAX_NAME) {
     if (value === null || value === undefined || value === "")
         return "";
-    // TAKES `unknown`, NOT `string` (2026-08-30). It was typed `string`, and
-    // `activity_data.device` turned out to be an OBJECT, so `.replace` threw and
-    // `ourpr_get_run` failed outright for every run — a whole tool lost to one
-    // wrong field type. A tool that returns nothing for one field is a small
-    // fault; a tool that throws is a total one, and this layer sits between the
-    // agent and data whose shape the server does not control.
-    //
-    // A primitive is printed. Anything else returns "" rather than the string
-    // "[object Object]": rendering junk into an agent's context is worse than
-    // rendering nothing, and nothing is what the caller already handles.
+    // A field can be any JSON value; only a primitive is printed.
     if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") {
         return "";
     }
     const flat = String(value)
-        // Every control character, newline and tab included. A newline in a cell
-        // ends the row early and every column after it shifts.
+        // A newline in a cell ends the row early.
         .replace(/[\u0000-\u001F\u007F]/g, " ")
-        // Zero-width and bidirectional marks: invisible in a transcript, and they
-        // are how text can read one way to a person and another to a parser.
+        // Zero-width and bidirectional marks hide text from a reader.
         .replace(/[\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF\u2060\u00AD]/g, "")
-        // The tag block, U+E0000-E007F: invisible characters that mirror ASCII,
-        // which is the known channel for smuggling hidden instructions.
+        // The tag block mirrors ASCII invisibly.
         .replace(/[\u{E0000}-\u{E007F}]/gu, "")
         .replace(/\s+/g, " ")
         .trim();
     const clipped = flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
-    // Escape rather than delete: a runner who named a run "5k | tempo" should
-    // still read it back as they wrote it.
+    // Escaped, not deleted, so "5k | tempo" reads back as written.
     return clipped.replace(/\|/g, "\\|");
 }
-/** Prose from one run — a description or a note. Same cleaning, longer cap. */
+/** Prose from one run, with the longer cap. */
 export const note = (value) => cell(value, MAX_NOTE);
-/**
- * Mark a block as the runner's own data rather than instructions.
- *
- * ONE LINE, NOT A PREAMBLE. It rides on every response that carries
- * runner-authored text, so its cost is paid on every call and its length is
- * part of its design. It is a reduction in how often injection lands, never a
- * guarantee, and the code must not be written as though it were one.
- */
+/** Marks a block as data; it reduces injection and does not prevent it. */
 export function fenced(body) {
     return ("<ourpr-data>\n" +
         body +

package/build/types.js

@@ -1,8 +1,2 @@
-// What the ourpr API returns, narrowed to the fields these tools read.
-//
-// DELIBERATELY PARTIAL. `DetailedActivity` on the backend carries far more
-// than this, and copying it whole would put every field into an agent's
-// context whether or not a tool uses it. These interfaces name what is read
-// and nothing else, which is the same whitelist discipline the backend's own
-// response model keeps.
+// Deliberately partial: only the fields a tool reads.
 export {};

package/manifest.json

@@ -1,12 +1,13 @@
 {
   "manifest_version": "0.3",
   "name": "ourpr-mcp-server",
-  "display_name": "ourpr",
-  "version": "0.2.0",
-  "description": "Read your own ourpr running history in Claude.",
-  "long_description": "Runs, mile splits, watch laps, streams, interval workouts and similar terrain, from your own ourpr account. Read only. The token comes from ourpr Settings and you can revoke it there at any time.",
+  "display_name": "ourpr.",
+  "version": "0.3.0",
+  "description": "Read your own ourpr running history in Claude, and plan the week ahead.",
+  "long_description": "Runs, mile splits, watch laps, streams, interval workouts and similar terrain, from your own ourpr account, plus one write: a plan on the week ahead, for a token made with the write scope. The token comes from ourpr Settings and you can revoke it there at any time.",
   "author": { "name": "Joey Flores", "url": "https://ourpr.app" },
   "homepage": "https://ourpr.app/your-runs",
+  "icon": "icon.png",
   "documentation": "https://github.com/joeyaflores/ourpr-mcp-server#readme",
   "support": "https://ourpr.app/support",
   "license": "MIT",
@@ -25,7 +26,7 @@
     "token": {
       "type": "string",
       "title": "Access token",
-      "description": "From ourpr: Settings, Access tokens, New token.",
+      "description": "In ourpr: Profile, Settings, ourpr. mcp, New token.",
       "sensitive": true,
       "required": true
     }
@@ -37,7 +38,8 @@
     { "name": "ourpr_run_laps", "description": "The laps the watch recorded." },
     { "name": "ourpr_rep_workouts", "description": "Every interval workout in your history." },
     { "name": "ourpr_detect_reps", "description": "Whether one run was an interval workout." },
-    { "name": "ourpr_similar_terrain", "description": "Runs that match a distance and a climb." }
+    { "name": "ourpr_similar_terrain", "description": "Runs that match a distance and a climb." },
+    { "name": "ourpr_plan_week", "description": "Put a plan on a day still ahead. The one write." }
   ],
   "compatibility": { "claude_desktop": ">=0.10.0", "platforms": ["darwin", "win32", "linux"], "runtimes": { "node": ">=22.14.0" } }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ourpr-mcp-server",
-  "version": "0.2.0",
-  "description": "MCP server that gives an AI agent read access to your own ourpr running history",
+  "version": "0.3.0",
+  "description": "MCP server for your own ourpr running history: read it, and put a plan on the week ahead",
   "mcpName": "io.github.joeyaflores/ourpr-mcp-server",
   "type": "module",
   "bin": {
@@ -10,7 +10,8 @@
   "files": [
     "build",
     "manifest.json",
-    "server.json"
+    "server.json",
+    "icon.png"
   ],
   "scripts": {
     "build": "tsc && node -e \"const fs=require('fs');const f='build/index.js';const c=fs.readFileSync(f,'utf8');if(!c.startsWith('#!')){fs.writeFileSync(f,'#!/usr/bin/env node\\n'+c)};fs.chmodSync(f,0o755)\"",

package/server.json

@@ -1,17 +1,17 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.joeyaflores/ourpr-mcp-server",
-  "description": "Read your own ourpr running history in an AI agent. Runs, splits, laps, streams, interval workouts.",
+  "description": "Read your own ourpr running history in an AI agent, and put a plan on the week ahead. Runs, splits, laps, streams, interval workouts.",
   "repository": {
     "url": "https://github.com/joeyaflores/ourpr-mcp-server",
     "source": "github"
   },
-  "version": "0.2.0",
+  "version": "0.3.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "ourpr-mcp-server",
-      "version": "0.2.0",
+      "version": "0.3.0",
       "transport": { "type": "stdio" },
       "environmentVariables": [
         {