relic-mcp 0.3.0 → 0.3.1

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
     {
       "name": "relic",
       "description": "Publish a file from your machine as an encrypted, shareable link. The agent encrypts locally, uploads only ciphertext, and hands back a URL whose fragment holds the key, so the service stores something it cannot read.",
-      "version": "0.3.0",
+      "version": "0.3.1",
       "source": "./",
       "author": {
         "name": "The Bushido Collective",
@@ -21,6 +21,6 @@
     }
   ],
   "metadata": {
-    "version": "0.3.0"
+    "version": "0.3.1"
   }
 }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "relic",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Publish a file from your machine as an encrypted, shareable link. The agent encrypts locally, uploads only ciphertext, and hands back a URL whose fragment holds the key, so the service stores something it cannot read.",
   "mcpServers": "./mcp-servers.json",
   "author": {

package/dist/relic-mcp.js

@@ -1093,13 +1093,21 @@ var DESCRIBE_TOOL_DEFINITION = {
     additionalProperties: false
   }
 };
-var SERVER_VERSION = "0.3.0";
+var SERVER_VERSION = "0.3.1";
 var SERVER_INFO = {
   name: "relic",
   title: "Relic",
   version: SERVER_VERSION
 };
 var CAPABILITIES = { tools: {} };
+var INSTRUCTIONS = `Relic turns a file on this machine into an encrypted link. Encryption happens locally, only ciphertext is uploaded, and the key lives in the URL fragment, which browsers never send to a server.
+
+Four things that change how you should act:
+
+1. The link is the credential. Anyone holding it, fragment included, can read the file. Do not paste it into a tracker, a log, or a public channel.
+2. Publishing puts the key in this transcript. That is structural rather than a defect, and worth saying plainly when you hand the link over.
+3. A relic can be republished only from the machine that published it, which is where its key and publish token are stored. Anywhere else it refuses, and no retry changes that.
+4. Rendered HTML and JSX run in an isolated frame with no network access. Inline the styles, scripts, fonts, and images a page needs, because a CDN reference renders as nothing. Decide that before you write the file.`;
 async function handleMessage(message, deps) {
   if (message.id === undefined)
     return;
@@ -1117,7 +1125,8 @@ async function handleMessage(message, deps) {
         result: {
           protocolVersions: [...SUPPORTED_PROTOCOL_VERSIONS],
           capabilities: CAPABILITIES,
-          serverInfo: SERVER_INFO
+          serverInfo: SERVER_INFO,
+          instructions: INSTRUCTIONS
         }
       };
     case "initialize": {
@@ -1128,7 +1137,8 @@ async function handleMessage(message, deps) {
         result: {
           protocolVersion: isSupportedVersion(asked) ? asked : PROTOCOL_VERSION,
           capabilities: CAPABILITIES,
-          serverInfo: SERVER_INFO
+          serverInfo: SERVER_INFO,
+          instructions: INSTRUCTIONS
         }
       };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relic-mcp",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Publish a file as an encrypted relic. The key is generated on your machine and never sent to the service.",
   "license": "MIT",
   "type": "module",

package/skills/relic/SKILL.md

@@ -85,9 +85,15 @@ Also worth one line, unprompted, the first time in a session:
 ## What the recipient gets
 
 A page that fetches the ciphertext, decrypts it in their browser, and renders
-by type. Markdown, code, images, and plain text render inline. HTML renders in
-a sandboxed frame on a separate origin, so a published page cannot reach the
-key or the service. Anything else offers a download.
+by type. Markdown, code, images, and plain text render inline. HTML and JSX
+render in a sandboxed frame on a separate origin, so a published page cannot
+reach the key or the service. Anything else offers a download.
+
+That frame has **no network access**: its policy permits no remote source at
+all, so a page cannot fetch, beacon, or load an external image, font, or
+script. Inline what a page needs when you generate it, because a CDN
+reference renders as nothing. The upside is that a relic cannot phone home or
+learn the recipient's IP address.
 
 They need the whole URL including the `#...` part. A link truncated at the `#`
 is a page that cannot decrypt anything, and that is the most common way sharing

package/src/server.ts

@@ -262,6 +262,40 @@ export const SERVER_INFO = {
 
 export const CAPABILITIES = { tools: {} } as const;
 
+/**
+ * Server-level guidance, returned on the handshake so a client can put it in
+ * the model's context before any tool is called.
+ *
+ * The plugin ships a skill with the same facts, but a skill only reaches
+ * Claude Code, and only when somebody installs the plugin rather than wiring
+ * this server directly. Every other client saw tool descriptions and nothing
+ * else, which left four things an agent cannot read off a schema.
+ *
+ * Item four is the reason this exists at all rather than living only in the
+ * publish result. The result is returned after the file is written, which is
+ * too late for an agent that already linked a stylesheet from a CDN. This
+ * lands before generation, which is the only moment the advice can be taken.
+ *
+ * It costs context on every session, so it stays short and it stays true.
+ * Anything that needs a paragraph belongs in the skill or the disclosure.
+ */
+export const INSTRUCTIONS = `Relic turns a file on this machine into an \
+encrypted link. Encryption happens locally, only ciphertext is uploaded, and \
+the key lives in the URL fragment, which browsers never send to a server.
+
+Four things that change how you should act:
+
+1. The link is the credential. Anyone holding it, fragment included, can read \
+the file. Do not paste it into a tracker, a log, or a public channel.
+2. Publishing puts the key in this transcript. That is structural rather than \
+a defect, and worth saying plainly when you hand the link over.
+3. A relic can be republished only from the machine that published it, which \
+is where its key and publish token are stored. Anywhere else it refuses, and \
+no retry changes that.
+4. Rendered HTML and JSX run in an isolated frame with no network access. \
+Inline the styles, scripts, fonts, and images a page needs, because a CDN \
+reference renders as nothing. Decide that before you write the file.`;
+
 /**
  * Handle one JSON-RPC message.
  *
@@ -297,6 +331,7 @@ export async function handleMessage(
           protocolVersions: [...SUPPORTED_PROTOCOL_VERSIONS],
           capabilities: CAPABILITIES,
           serverInfo: SERVER_INFO,
+          instructions: INSTRUCTIONS,
         },
       };
 
@@ -312,6 +347,7 @@ export async function handleMessage(
           protocolVersion: isSupportedVersion(asked) ? asked : PROTOCOL_VERSION,
           capabilities: CAPABILITIES,
           serverInfo: SERVER_INFO,
+          instructions: INSTRUCTIONS,
         },
       };
     }