screenpipe-mcp 0.20.0 → 0.20.2

package/scripts/build-installers.mjs

@@ -0,0 +1,75 @@
+// screenpipe — AI that knows everything you've seen, said, or heard
+// https://screenpipe.com
+
+import { readFileSync, writeFileSync, mkdirSync, mkdtempSync, rmSync, copyFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { packExtension } from "@anthropic-ai/mcpb/cli";
+import { zipSync } from "fflate";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const output = path.join(root, "installers");
+const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
+const read = (file) => readFileSync(path.join(root, file));
+const json = (value) => Buffer.from(JSON.stringify(value, null, 2) + "\n");
+const icon = readFileSync(path.join(root, "../../apps/screenpipe-app-tauri/src-tauri/icons/512x512.png"));
+const license = readFileSync(path.join(root, "../../LICENSE.md"));
+
+// Rebuild instead of shipping a stale dist/. Only explicitly listed files enter
+// either archive, never credentials, local config, sources, or node_modules.
+execFileSync("bun", ["run", "build"], { cwd: root, stdio: "inherit" });
+mkdirSync(output, { recursive: true });
+const stage = mkdtempSync(path.join(tmpdir(), "screenpipe-installers-"));
+try {
+  const manifest = JSON.parse(read("manifest.json"));
+  manifest.version = pkg.version;
+  manifest.icon = "icon.png";
+  const localFiles = {
+    "manifest.json": json(manifest),
+    "package.json": json({ name: pkg.name, version: pkg.version, license: pkg.license }),
+    "dist/index.js": read("dist/index.js"),
+    "README.md": read("README.md"),
+    "LICENSE.md": license,
+    "icon.png": icon,
+  };
+  for (const [file, bytes] of Object.entries(localFiles)) {
+    const target = path.join(stage, file);
+    mkdirSync(path.dirname(target), { recursive: true });
+    writeFileSync(target, bytes);
+  }
+  const localArchive = path.join(output, "screenpipe-local.mcpb");
+  if (!await packExtension({ extensionPath: stage, outputPath: localArchive, silent: true })) {
+    throw new Error("MCPB validation or packaging failed");
+  }
+
+  const portable = JSON.parse(read("plugins/screenpipe-cloud/plugin.json"));
+  const mcp = JSON.parse(read("plugins/screenpipe-cloud/mcp.json"));
+  const { $schema, extensions, ...identity } = portable;
+  const legacyMcp = { mcpServers: Object.fromEntries(Object.entries(mcp.mcpServers)
+    .map(([name, config]) => [name, { ...config, type: "http" }])) };
+  const cloudFiles = {
+    "plugin.json": json(portable),
+    "mcp.json": json(mcp),
+    ".claude-plugin/plugin.json": json(identity),
+    ".codex-plugin/plugin.json": json({ ...identity, mcpServers: "./.mcp.json", ...extensions["com.openai"] }),
+    ".mcp.json": json(legacyMcp),
+    "assets/icon.png": icon,
+    "README.md": read("plugins/screenpipe-cloud/README.md"),
+    "LICENSE.md": license,
+  };
+  // Expose the same directory as the ZIP for local host validation/install.
+  const cloudDir = path.join(output, "screenpipe-cloud");
+  rmSync(cloudDir, { recursive: true, force: true });
+  for (const [file, bytes] of Object.entries(cloudFiles)) {
+    const target = path.join(cloudDir, file);
+    mkdirSync(path.dirname(target), { recursive: true });
+    writeFileSync(target, bytes);
+  }
+  writeFileSync(path.join(output, "screenpipe-cloud.zip"), zipSync(cloudFiles));
+  copyFileSync(path.join(root, "plugins/screenpipe-cloud/SUBMISSION.md"), path.join(output, "SUBMISSION.md"));
+  console.log(`Installers written to ${output}`);
+} finally {
+  rmSync(stage, { recursive: true, force: true });
+}

package/server.json

@@ -8,13 +8,13 @@
     "source": "github",
     "subfolder": "packages/screenpipe-mcp"
   },
-  "version": "0.20.0",
+  "version": "0.20.2",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "screenpipe-mcp",
-      "version": "0.20.0",
+      "version": "0.20.2",
       "transport": {
         "type": "stdio"
       }

package/src/http-server.test.ts

@@ -185,6 +185,67 @@ describe("isAuthorized", () => {
 });
 
 describe("buildHttpServer", () => {
+  it.each([
+    { name: "local API key", localKey: "upstream-secret", apiKey: "other-key", succeeds: true },
+    { name: "API key fallback", localKey: "", apiKey: "upstream-secret", succeeds: true },
+    { name: "missing upstream key", localKey: "", apiKey: "", succeeds: false },
+    { name: "invalid upstream key", localKey: "wrong-key", apiKey: "", succeeds: false },
+  ])("authenticates upstream independently of the MCP bearer: $name", async ({ localKey, apiKey, succeeds }) => {
+    const requests: Array<{ path: string; authorization: string | undefined }> = [];
+    const api = createServer((request, response) => {
+      requests.push({ path: request.url!, authorization: request.headers.authorization });
+      response.setHeader("content-type", "application/json");
+      if (request.headers.authorization !== "Bearer upstream-secret") {
+        response.writeHead(403).end(JSON.stringify({ error: "unauthorized" }));
+        return;
+      }
+      response.end(JSON.stringify({
+        data: [{ type: "OCR", content: { text: "synthetic authenticated result" } }],
+        pagination: { total: 1 },
+      }));
+    });
+    await new Promise<void>(resolve => api.listen(0, "127.0.0.1", resolve));
+    const apiPort = (api.address() as { port: number }).port;
+    vi.stubEnv("SCREENPIPE_API_URL", `http://127.0.0.1:${apiPort}`);
+    vi.stubEnv("SCREENPIPE_LOCAL_API_KEY", localKey);
+    vi.stubEnv("SCREENPIPE_API_KEY", apiKey);
+    const server = buildHttpServer({
+      mcpPort: 0,
+      screenpipePort: apiPort,
+      host: "127.0.0.1",
+      apiKey: "mcp-client-secret",
+    });
+    const client = new Client({ name: "integration-test", version: "1.0.0" });
+    try {
+      await new Promise<void>(resolve => server.listen(0, "127.0.0.1", resolve));
+      const url = new URL(`http://127.0.0.1:${(server.address() as { port: number }).port}/mcp`);
+      await client.connect(new StreamableHTTPClientTransport(url, {
+        requestInit: { headers: { authorization: "Bearer mcp-client-secret" } },
+      }));
+      const call = client.callTool({ name: "search_content", arguments: { q: "fixture", limit: 1 } });
+      if (succeeds) {
+        const result = await call;
+        expect(result.isError).not.toBe(true);
+        expect(result.content).toEqual([expect.objectContaining({
+          type: "text", text: expect.stringContaining("synthetic authenticated result"),
+        })]);
+        await vi.waitFor(() => expect(requests.some(request => request.path === "/internal/telemetry/mcp-value")).toBe(true));
+        expect(requests.every(request => request.authorization === "Bearer upstream-secret")).toBe(true);
+      } else {
+        await expect(call).rejects.toThrow("HTTP error: 403");
+        expect(requests).toHaveLength(1);
+      }
+      expect(requests[0].path).toBe("/search?q=fixture&limit=1");
+      expect(requests.some(request => request.authorization === "Bearer mcp-client-secret")).toBe(false);
+    } finally {
+      await client.close();
+      server.closeAllConnections();
+      api.closeAllConnections();
+      await Promise.all([server, api].map(s => new Promise<void>(resolve => s.close(() => resolve()))));
+      vi.unstubAllEnvs();
+    }
+  });
+
   it("attributes retrievals per HTTP session and excludes empty or failed searches", async () => {
     const searches: Array<{ source: unknown; agent: unknown }> = [];
     const outcomes: unknown[] = [];

package/src/http-server.ts

@@ -201,11 +201,13 @@ function makeFetchAPI(screenpipePort: number, client: () => McpClient) {
     /\/+$/,
     "",
   );
+  const apiKey = process.env.SCREENPIPE_LOCAL_API_KEY || process.env.SCREENPIPE_API_KEY;
   return async (endpoint: string, options: RequestInit = {}): Promise<Response> =>
     fetch(`${base}${endpoint}`, {
       ...options,
       headers: {
         "Content-Type": "application/json",
+        ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
         "x-screenpipe-client": "mcp",
         "x-screenpipe-agent": client(),
         ...options.headers,

package/src/installers.test.ts

@@ -0,0 +1,143 @@
+// screenpipe — AI that knows everything you've seen, said, or heard
+// https://screenpipe.com
+
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, readFileSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createServer, type Server } from "node:http";
+import { unzipSync } from "fflate";
+import { VERSIONED_MANIFEST_SCHEMAS } from "@anthropic-ai/mcpb/schemas";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+
+const root = path.resolve(__dirname, "..");
+const sandbox = mkdtempSync(path.join(tmpdir(), "screenpipe-installer-test-"));
+let local: Record<string, Uint8Array>;
+let cloud: Record<string, Uint8Array>;
+let api: Server;
+let baseUrl: string;
+let status = 200;
+let seenAuth: string | undefined;
+let seenQuery: string | null;
+const parse = (archive: Record<string, Uint8Array>, file: string) =>
+  JSON.parse(Buffer.from(archive[file]).toString("utf8"));
+
+beforeAll(async () => {
+  execFileSync("bun", ["run", "build:installers"], { cwd: root, timeout: 120_000, stdio: "inherit" });
+  local = unzipSync(readFileSync(path.join(root, "installers/screenpipe-local.mcpb")));
+  cloud = unzipSync(readFileSync(path.join(root, "installers/screenpipe-cloud.zip")));
+  for (const [file, bytes] of Object.entries(local)) {
+    const target = path.join(sandbox, file);
+    mkdirSync(path.dirname(target), { recursive: true });
+    writeFileSync(target, bytes);
+  }
+  api = createServer((req, res) => {
+    const url = new URL(req.url!, "http://localhost");
+    if (url.pathname !== "/search") {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end("{}");
+      return;
+    }
+    seenAuth = req.headers.authorization;
+    seenQuery = url.searchParams.get("q");
+    res.writeHead(status, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(status === 200 ? {
+      data: [{ type: "OCR", content: { text: "synthetic installer evidence", timestamp: "2026-01-02T12:00:00Z", app_name: "Fixture", frame_id: 1 } }],
+      pagination: { total: 1, limit: 5, offset: 0 },
+    } : { error: "unauthorized" }));
+  });
+  await new Promise<void>((resolve) => api.listen(0, "127.0.0.1", resolve));
+  baseUrl = `http://127.0.0.1:${(api.address() as { port: number }).port}`;
+}, 130_000);
+
+afterAll(async () => {
+  if (api) await new Promise<void>((resolve) => api.close(() => resolve()));
+  rmSync(sandbox, { recursive: true, force: true });
+});
+
+async function withInstalledClient(run: (client: Client) => Promise<void>) {
+  const manifest = parse(local, "manifest.json");
+  const config = manifest.server.mcp_config;
+  const settings: Record<string, string> = { api_url: baseUrl, api_key: "sp-installer-fixture" };
+  const env: Record<string, string> = {
+    PATH: "", NODE_PATH: "", SCREENPIPE_DISABLE_TELEMETRY: "1",
+    SCREENPIPE_ENTERPRISE_TOKEN: "sk_ent_fixture", SCREENPIPE_TEAM_API_URL: baseUrl,
+  };
+  for (const [key, value] of Object.entries(config.env)) {
+    env[key] = String(value).replace(/\$\{user_config\.(\w+)\}/g, (_, name) => settings[name]);
+  }
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: config.args.map((arg: string) => arg.replace("${__dirname}", sandbox)),
+    cwd: sandbox, env, stderr: "pipe",
+  });
+  const client = new Client({ name: "installer-fixture", version: "1.0.0" });
+  try {
+    await client.connect(transport);
+    await run(client);
+  } finally {
+    await transport.close();
+  }
+}
+
+describe("installable MCP artifacts", () => {
+  it("ships a schema-valid local extension with only the required files", () => {
+    const manifest = parse(local, "manifest.json");
+    expect(VERSIONED_MANIFEST_SCHEMAS["0.3"].safeParse(manifest).success).toBe(true);
+    expect(Object.keys(local).sort()).toEqual([
+      "LICENSE.md", "README.md", "dist/index.js", "icon.png", "manifest.json", "package.json",
+    ]);
+    expect(manifest.version).toBe(JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).version);
+    expect(manifest.user_config.api_key.sensitive).toBe(true);
+    expect(manifest.user_config.api_key.default).toBeUndefined();
+    expect(manifest.user_config.api_key.required).toBe(false);
+    expect(manifest.user_config.api_url.default).toBe("http://127.0.0.1:3030");
+    expect(local[manifest.server.entry_point]).toBeDefined();
+  });
+
+  it("initializes and searches from the extracted archive with no runtime dependencies", async () => {
+    status = 200;
+    await withInstalledClient(async (client) => {
+      const list = await client.listTools();
+      expect(list.tools.some((tool) => tool.name === "search-content")).toBe(true);
+      const result = await client.callTool({ name: "search-content", arguments: {
+        q: "synthetic", start_time: "2026-01-02T00:00:00Z", end_time: "2026-01-03T00:00:00Z", limit: 5,
+      } });
+      expect(result.isError).not.toBe(true);
+      expect(JSON.stringify(result)).toContain("synthetic installer evidence");
+      expect(seenAuth).toBe("Bearer sp-installer-fixture");
+      expect(seenQuery).toBe("synthetic");
+    });
+  }, 15_000);
+
+  it("reports rejected authentication rather than successful retrieval", async () => {
+    status = 401;
+    await withInstalledClient(async (client) => {
+      const result = await client.callTool({ name: "search-content", arguments: { q: "synthetic", limit: 1 } });
+      expect(result.isError).toBe(true);
+      expect(JSON.stringify(result)).not.toContain("synthetic installer evidence");
+    });
+  }, 15_000);
+
+  it("keeps all cloud hosts on the same OAuth endpoint without embedding credentials", () => {
+    expect(Object.keys(cloud).sort()).toEqual([
+      ".claude-plugin/plugin.json", ".codex-plugin/plugin.json", ".mcp.json",
+      "LICENSE.md", "README.md", "assets/icon.png", "mcp.json", "plugin.json",
+    ]);
+    const portable = parse(cloud, "plugin.json");
+    const codex = parse(cloud, ".codex-plugin/plugin.json");
+    const claude = parse(cloud, ".claude-plugin/plugin.json");
+    for (const manifest of [portable, codex, claude]) {
+      expect(manifest.name).toBe("screenpipe-cloud");
+      expect(manifest.version).toBe(portable.version);
+    }
+    const endpoint = "https://screenpipe.com/api/user/data-sync/mcp";
+    expect(parse(cloud, "mcp.json").mcpServers).toEqual({ "screenpipe-cloud": { type: "streamable-http", url: endpoint } });
+    expect(parse(cloud, ".mcp.json").mcpServers).toEqual({ "screenpipe-cloud": { type: "http", url: endpoint } });
+    expect(codex.mcpServers).toBe("./.mcp.json");
+    expect(codex.interface.capabilities).toEqual(["Read"]);
+    expect(cloud[codex.interface.logo.replace(/^\.\//, "")]).toBeDefined();
+  });
+});

package/src/qualified-value.test.ts

@@ -55,6 +55,7 @@ describe("createMcpQualifiedValueReporter", () => {
     ["chatgpt", "ChatGPT", "chatgpt"],
     ["gemini", "gemini-cli", "gemini"],
     ["runner", "Runner", "runner"],
+    ["vscode", "vscode", "vscode"],
     ["grokbot", "Grok Bot", "grokbot"],
   ])("recognizes configured %s and its handshake name", (configured, protocol, expected) => {
     expect(resolveMcpClient(configured, "unrecognized-client")).toBe(expected);

package/src/qualified-value.ts

@@ -4,7 +4,7 @@
 
 const CLIENTS = [
   "claude", "chatgpt", "codex", "cursor", "gemini", "openclaw",
-  "hermes", "runner", "windsurf", "grok", "grokbot",
+  "hermes", "runner", "windsurf", "vscode", "grok", "grokbot",
 ] as const;
 export type McpClient = (typeof CLIENTS)[number] | "unknown";