pipebrain-mcp 0.16.0 → 0.16.4

package/README.md

@@ -9,16 +9,24 @@ This package is the **server only**. The command line tool is a separate package
 
 ## Install
 
-Register it with Claude Code (no install step — `npx` fetches it):
+Register it with Claude Code (no install step — `npx` fetches it), at **user scope** so
+every repo on the machine gets the tools:
 
 ```
-claude mcp add pipebrain -- npx -y pipebrain-mcp
+claude mcp add pipebrain -s user -e PIPEBRAIN_API_URL=https://api.pipebrain.dev -e 'PIPEBRAIN_TOKEN=${PIPEBRAIN_TOKEN}' -- npx -y pipebrain-mcp@latest
 ```
 
-The server reads its configuration from the environment of the process that launches it,
-and refuses to start if either value is missing or malformed — including an unexpanded
-`${PIPEBRAIN_TOKEN}` placeholder, which is the failure that otherwise looks like a
-revoked token.
+Both `-e` flags are required, not decoration. The server reads its configuration from the
+environment of the process that launches it, and refuses to start if either value is
+missing or malformed — including an unexpanded `${PIPEBRAIN_TOKEN}` placeholder, which is
+the failure that otherwise looks like a revoked token. There is no default API URL (see
+the table below), so a registration that passes neither flag produces a server that never
+starts.
+
+The single quotes around the token are load-bearing: they keep `${PIPEBRAIN_TOKEN}` a
+literal *reference* in Claude's config instead of expanding it as you type, so the token
+value itself never lands in a config file — the server resolves it from your environment
+at each launch.
 
 ## Environment
 
@@ -27,9 +35,6 @@ revoked token.
 | `PIPEBRAIN_TOKEN` | Your `pbt_…` API token (Settings → Organization → API tokens). A pre-rename `plt_…` token still works. |
 | `PIPEBRAIN_API_URL` | API base URL, e.g. `https://api.pipebrain.dev`. Required — there is no default, so a session can always tell which environment it is bound to. |
 
-The pre-rename names `PIPELINE_TOKEN` and `PIPELINE_API_URL` are still honored as
-fallbacks, indefinitely. When both are set, `PIPEBRAIN_*` wins.
-
 Secret VALUES never cross this server: the secrets tools return metadata only, and there
 is deliberately no value-returning tool. Use `ppb secrets` (from `pipebrain-cli`) for the
 reveal plane.

package/dist/main.js

@@ -16753,7 +16753,7 @@ ${general}`;
 }
 
 // ../../libs/mcp-server/dist/server.js
-var SUCCESSOR_NOTICE = "NOTICE \u2014 this server is the FINAL release of the `@fvcsolutions/pipeline-mcp` package. The server moved to `pipebrain-mcp` on npmjs.org (public, no registry auth), and the CLI moved to `pipebrain-cli`, which provides the `ppb` command in place of `pipeline`. Re-register through the team bootstrap, or: `claude mcp add pipebrain -- npx -y pipebrain-mcp`. Tell the operator; this build still works and will not be updated again.\n\n";
+var SUCCESSOR_NOTICE = "NOTICE \u2014 this server is the FINAL release of the `@fvcsolutions/pipeline-mcp` package. The server moved to `pipebrain-mcp` on npmjs.org (public, no registry auth), and the CLI moved to `pipebrain-cli`, which provides the `ppb` command in place of `pipeline`. Re-register through the team bootstrap, or: `claude mcp add pipebrain -s user -e PIPEBRAIN_API_URL=https://api.pipebrain.dev -e 'PIPEBRAIN_TOKEN=${PIPEBRAIN_TOKEN}' -- npx -y pipebrain-mcp@latest`. Tell the operator; this build still works and will not be updated again.\n\n";
 function successorNotice() {
   const armed = process.env.PIPELINE_MCP_SUCCESSOR_NOTICE;
   return armed === void 0 || armed === "" ? "" : SUCCESSOR_NOTICE;
@@ -16809,6 +16809,7 @@ async function resolveDeliverableTargetId(client2, projectKey, ref) {
   return match.id;
 }
 function createMcpServer(client2, apiBaseUrl, orgInstructions2 = /* @__PURE__ */ new Map(), opts = {}) {
+  const surface = opts.surface ?? "local";
   const server2 = new McpServer({ name: "pipebrain", version: opts.version ?? DEFAULT_VERSION }, {
     instructions: withGeneralInstructions(successorNotice() + `Pipebrain MCP server, bound to the ${apiBindingLabel(apiBaseUrl)} API at ${apiBaseUrl}. Every tool reads and writes THAT environment \u2014 confirm it is the one you intend (a local dev API vs production) before mutating. Tools are namespaced by this server's registration name in .mcp.json (e.g. pipebrain-local:* vs pipebrain:*).`, orgInstructions2)
   });
@@ -17077,21 +17078,23 @@ function createMcpServer(client2, apiBaseUrl, orgInstructions2 = /* @__PURE__ */
     }
   }, ({ deliverable, ...fields }) => run(() => client2.promoteDeliverable(deliverable, fields)));
   registerTool("list_assets", {
-    description: "List project assets (S3-backed files of any type) filtered by project, status (pending/active/rejected), category (image/video/document), and filename text, sorted by date or size (asc/desc): id, filename, contentType, size, sha256, status, hasThumbnail, and linkCount (live references). Metadata only \u2014 the bytes move by path (upload_asset/download_asset), never through this result.",
+    description: "List project assets (S3-backed files of any type) filtered by project, status (pending/active/rejected), category (image/video/document), and filename text, sorted by date or size (asc/desc): id, filename, contentType, size, sha256, status, hasThumbnail, and linkCount (live references). Metadata only \u2014 the bytes move by path, never through this result.",
     inputSchema: listAssetsFilterSchema.shape
   }, (args) => run(() => client2.listAssets(args)));
   registerTool("get_asset", {
-    description: "Get an asset\u2019s metadata by uuid: filename, contentType, size, sha256 (client-computed, server-verified by read-back), status, hasThumbnail, linkCount (live references), and timestamps. Metadata only \u2014 no value/URL is returned over MCP; use download_asset to write the bytes to a local file.",
+    description: "Get an asset\u2019s metadata by uuid: filename, contentType, size, sha256 (client-computed, server-verified by read-back), status, hasThumbnail, linkCount (live references), and timestamps. Metadata only \u2014 no value/URL is returned over MCP. To get the bytes, use download_asset (a LOCAL server only \u2014 it writes to a path on the machine running the server) or `ppb assets download`.",
     inputSchema: { asset: uuidSchema }
   }, (args) => run(() => client2.getAsset(args.asset)));
-  registerTool("upload_asset", {
-    description: "Upload a LOCAL FILE (by path) as a project asset and activate it: reads and SHA-256-hashes the file locally, registers the asset, PUTs the bytes directly to storage, and completes (server verifies the digest by read-back). Returns the asset metadata (status active on success). Only the file PATH crosses the wire \u2014 the bytes never do; do NOT pass base64 or file contents. contentType is guessed from the extension when omitted. Then use link_asset to attach the returned asset to a deliverable revision or a content draft.",
-    inputSchema: uploadAssetInputSchema.shape
-  }, (args) => run(() => uploadAssetFromPath(client2, apiBaseUrl, args)));
-  registerTool("download_asset", {
-    description: "Download an ACTIVE asset\u2019s bytes to a LOCAL FILE at `path` (created/overwritten), so you can read or view an uploaded image, mockup, or document. The bytes are written to disk and re-verified against the recorded sha256; the RESULT is metadata + the written path \u2014 never the bytes or a URL. Addressed by asset uuid (from list_assets, get_asset, or get_content).",
-    inputSchema: downloadAssetInputSchema.shape
-  }, (args) => run(() => downloadAssetToPath(client2, args)));
+  if (surface === "local") {
+    registerTool("upload_asset", {
+      description: "Upload a LOCAL FILE (by path) as a project asset and activate it: reads and SHA-256-hashes the file locally, registers the asset, PUTs the bytes directly to storage, and completes (server verifies the digest by read-back). Returns the asset metadata (status active on success). Only the file PATH crosses the wire \u2014 the bytes never do; do NOT pass base64 or file contents. contentType is guessed from the extension when omitted. Then use link_asset to attach the returned asset to a deliverable revision or a content draft.",
+      inputSchema: uploadAssetInputSchema.shape
+    }, (args) => run(() => uploadAssetFromPath(client2, apiBaseUrl, args)));
+    registerTool("download_asset", {
+      description: "Download an ACTIVE asset\u2019s bytes to a LOCAL FILE at `path` (created/overwritten), so you can read or view an uploaded image, mockup, or document. The bytes are written to disk and re-verified against the recorded sha256; the RESULT is metadata + the written path \u2014 never the bytes or a URL. Addressed by asset uuid (from list_assets, get_asset, or get_content).",
+      inputSchema: downloadAssetInputSchema.shape
+    }, (args) => run(() => downloadAssetToPath(client2, args)));
+  }
   registerTool("link_asset", {
     description: "Reference an active asset FROM a target. Two targets are wired: `deliverable_revision` (targetId is a content_deliverable_revision uuid, e.g. from get_content) and `content_draft` (targetId is a content_draft uuid \u2014 the asset attaches to the topic doc and is snapshot-copied onto deliverables when they are created). Rejects a non-active asset or a cross-project link.",
     inputSchema: linkAssetInputSchema.shape
@@ -17232,7 +17235,7 @@ function loadMcpConfig() {
 }
 
 // src/version.ts
-var VERSION = "0.16.0";
+var VERSION = "0.16.4";
 
 // src/main.ts
 var config2 = loadMcpConfig();
@@ -17241,7 +17244,10 @@ var client = new ApiClient({
   auth: { bearer: config2.token }
 });
 var orgInstructions = await fetchOrgInstructionsSafe(client);
-var server = createMcpServer(client, config2.apiUrl, orgInstructions, { version: VERSION });
+var server = createMcpServer(client, config2.apiUrl, orgInstructions, {
+  version: VERSION,
+  surface: "local"
+});
 var transport = new StdioServerTransport();
 await server.connect(transport);
 var notice = successorNotice();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pipebrain-mcp",
-  "version": "0.16.0",
+  "version": "0.16.4",
   "description": "Pipebrain MCP server for Claude Code and Claude Desktop — issues, requirements, content, assets, and metadata-only secrets over the Pipebrain API.",
   "type": "module",
   "license": "MIT",
@@ -13,7 +13,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/fvcsolutions/pipeline.git",
+    "url": "git+https://github.com/fvcsolutions/pipebrain.git",
     "directory": "apps/mcp"
   },
   "publishConfig": {
@@ -26,7 +26,7 @@
     "test": "NODE_OPTIONS=--experimental-vm-modules jest",
     "build": "node build.mjs",
     "build:mcpb": "nx build pipebrain-mcp && node mcpb/build-mcpb.mjs",
-    "prepack": "npx nx build pipebrain-mcp"
+    "prepack": "npx nx build pipebrain-mcp && node ../../scripts/check-publishable.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.29.0"