setlist-mcp 0.5.1 → 0.6.1

package/dist/fetchproxy-cookie.js

@@ -0,0 +1,57 @@
+import { readEnvVar } from '@chrischall/mcp-utils';
+import { VERSION } from './version.js';
+// The cookies that authenticate a www.setlist.fm session: JSESSIONID is the
+// (HttpOnly) Wicket session, RememberMeCookie re-establishes login, aws-waf-token
+// clears the WAF. read_cookies uses chrome.cookies.get, which DOES see HttpOnly
+// cookies (page JS cannot), so the bridge can lift JSESSIONID.
+const SESSION_COOKIE_KEYS = ['JSESSIONID', 'RememberMeCookie', 'aws-waf-token'];
+// Bound the bridge round-trip so a wedged/absent extension fails fast instead of
+// hanging the tool call.
+const BOOTSTRAP_TIMEOUT_MS = 15_000;
+function fetchproxyDisabled() {
+    const raw = readEnvVar('SETLIST_DISABLE_FETCHPROXY');
+    return raw !== undefined && ['1', 'true', 'yes', 'on'].includes(raw.toLowerCase());
+}
+function withTimeout(p, ms) {
+    return Promise.race([
+        p,
+        new Promise((_, reject) => setTimeout(() => reject(new Error('fetchproxy: timed out waiting for the browser bridge. Is the Transporter extension running and signed into setlist.fm in that browser?')), ms).unref?.()),
+    ]);
+}
+/**
+ * One-shot fetchproxy bootstrap: lift the logged-in setlist.fm session cookies
+ * out of the signed-in browser tab (via the Transporter extension), assemble a
+ * `Cookie` header, and return it — fetchproxy is NOT in the hot path afterward.
+ * Used only when `SETLIST_SESSION_COOKIE` is unset.
+ *
+ * Returns `null` when the fallback is disabled; throws an actionable error if the
+ * bridge is unreachable or no session cookie is present.
+ */
+export async function grabSessionCookie() {
+    if (fetchproxyDisabled())
+        return null;
+    let bootstrap;
+    try {
+        ({ bootstrap } = await import('@fetchproxy/bootstrap'));
+    }
+    catch {
+        return null; // bridge package unavailable (shouldn't happen — bundled)
+    }
+    // Declare the apex `setlist.fm` scope (so a re-render with no scope change
+    // never needs re-approval), but read cookies from the `www` subdomain — the
+    // session cookies are host-only on www.setlist.fm, and www is a subdomain of
+    // the approved apex, so chrome.cookies.get sees JSESSIONID without a re-pair.
+    const session = await withTimeout(bootstrap({
+        serverName: 'setlist-mcp',
+        version: VERSION,
+        domains: ['setlist.fm'],
+        storageSubdomain: 'www',
+        declare: { cookies: SESSION_COOKIE_KEYS, localStorage: [], sessionStorage: [], captureHeaders: [] },
+    }), BOOTSTRAP_TIMEOUT_MS);
+    const cookies = session.cookies ?? {};
+    const header = SESSION_COOKIE_KEYS.filter((k) => cookies[k]).map((k) => `${k}=${cookies[k]}`).join('; ');
+    if (!cookies.JSESSIONID && !cookies.RememberMeCookie) {
+        throw new Error('fetchproxy: no setlist.fm session cookie found — sign in at https://www.setlist.fm in the browser running the Transporter extension, then retry.');
+    }
+    return header;
+}

package/dist/index.js

@@ -7,6 +7,7 @@ import { registerVenueTools } from './tools/venues.js';
 import { registerGeoTools } from './tools/geo.js';
 import { registerUserTools } from './tools/users.js';
 import { registerResolveTools } from './tools/resolve.js';
+import { registerAttendanceTools } from './tools/attendance.js';
 import { registerUtilityTools } from './tools/utilities.js';
 // The setlist.fm client is a module-level singleton (imported by each tool
 // module) that defers its config error to the first request. That preserves the
@@ -24,6 +25,7 @@ await runMcp({
         registerGeoTools,
         registerUserTools,
         registerResolveTools,
+        registerAttendanceTools,
         registerUtilityTools,
     ],
 });

package/dist/tools/attendance.js

@@ -0,0 +1,100 @@
+import { z } from 'zod';
+import { textResult } from '@chrischall/mcp-utils';
+import { client } from '../client.js';
+import { webClient } from '../web-client.js';
+import { ATTRIBUTION_NOTE } from '../attribution.js';
+function decodeEntities(s) {
+    return s
+        .replace(/&/g, '&')
+        .replace(/&#x([0-9a-f]+);/gi, (_, h) => String.fromCharCode(parseInt(h, 16)))
+        .replace(/&#(\d+);/g, (_, d) => String.fromCharCode(Number(d)));
+}
+/**
+ * Locate the attendance toggle in a logged-in setlist page and read its state.
+ * The control is a Wicket `wicketAjaxGet(...)` anchor whose title is
+ * "Add this setlist to your attended shows." (not attended) or
+ * "Remove this setlist from your attended shows." (attended).
+ */
+export function parseAttendance(html) {
+    for (const seg of html.split(/<a\b/i).slice(1)) {
+        const a = '<a ' + seg.slice(0, 800);
+        if (!/wicketAjaxGet/.test(a))
+            continue;
+        const title = (a.match(/title="([^"]*attended shows[^"]*)"/i) || [])[1];
+        if (!title)
+            continue;
+        const url = (a.match(/wicketAjaxGet\(\s*['"]([^'"]+)['"]/) || [])[1];
+        if (!url)
+            continue;
+        return { ajaxUrl: decodeEntities(url), attended: /remove/i.test(title) };
+    }
+    return null;
+}
+async function setAttendance(setlistId, desired, confirm) {
+    // Resolve the canonical setlist page URL via the public API.
+    const meta = await client.request('GET', `/1.0/setlist/${encodeURIComponent(setlistId)}`);
+    if (!meta?.url)
+        throw new Error(`No setlist found for id "${setlistId}".`);
+    const path = new URL(meta.url).pathname;
+    const summary = {
+        setlistId,
+        url: meta.url,
+        artist: meta.artist?.name,
+        eventDate: meta.eventDate,
+        venue: meta.venue?.name,
+        city: meta.venue?.city?.name,
+    };
+    const control = parseAttendance(await webClient.fetchPage(path));
+    if (!control) {
+        throw new Error('Could not find the attendance control on the setlist page — your setlist.fm session has likely expired (re-copy SETLIST_SESSION_COOKIE) or the page layout changed.');
+    }
+    if (control.attended === desired) {
+        return {
+            ...summary,
+            attended: desired,
+            changed: false,
+            note: desired ? 'Already marked as attended.' : 'Not currently attended — nothing to remove.',
+        };
+    }
+    if (!confirm) {
+        return {
+            ...summary,
+            currentlyAttended: control.attended,
+            wouldSetAttendedTo: desired,
+            dryRun: true,
+            note: `Dry run — re-run with confirm: true to ${desired ? 'record' : 'remove'} this attendance.`,
+        };
+    }
+    // Replay the per-render Wicket toggle, then VERIFY by re-reading (a 200 is not proof).
+    const u = new URL(control.ajaxUrl, meta.url);
+    await webClient.wicketAjaxGet(u.pathname + u.search, path.replace(/^\//, ''));
+    const after = parseAttendance(await webClient.fetchPage(path));
+    const verified = after?.attended === desired;
+    return {
+        ...summary,
+        attended: desired,
+        changed: true,
+        verified,
+        ...(verified ? {} : { warning: 'Toggle sent, but the re-read did not confirm the new state — check on setlist.fm.' }),
+    };
+}
+export function registerAttendanceTools(server) {
+    server.registerTool('setlist_mark_attended', {
+        description: "Record on YOUR setlist.fm account that you attended a show — the site's \"I was there\" marker — by setlist ID. Authenticated via your session (needs SETLIST_SESSION_COOKIE). Idempotent: a no-op if already marked. Without confirm: true it returns a dry-run preview and makes NO change; with confirm: true it toggles attendance and verifies by re-reading your attended list." +
+            ATTRIBUTION_NOTE,
+        annotations: { readOnlyHint: false, idempotentHint: true, openWorldHint: true },
+        inputSchema: {
+            setlistId: z.string().describe('Setlist ID (e.g. from setlist_search_setlists / resolve_concerts)'),
+            confirm: z.boolean().optional().describe('Must be true to actually record attendance; omit for a dry-run preview.'),
+        },
+    }, async ({ setlistId, confirm }) => textResult(await setAttendance(setlistId, true, confirm === true)));
+    server.registerTool('setlist_unmark_attended', {
+        description: 'Remove a show from YOUR attended list on setlist.fm, by setlist ID (reverses setlist_mark_attended). Authenticated via your session. Idempotent: a no-op if not currently attended. Without confirm: true it returns a dry-run preview and makes NO change; with confirm: true it removes the attendance and verifies by re-reading.' +
+            ATTRIBUTION_NOTE,
+        annotations: { readOnlyHint: false, idempotentHint: true, destructiveHint: true, openWorldHint: true },
+        inputSchema: {
+            setlistId: z.string().describe('Setlist ID to remove from your attended shows'),
+            confirm: z.boolean().optional().describe('Must be true to actually remove attendance; omit for a dry-run preview.'),
+        },
+    }, async ({ setlistId, confirm }) => textResult(await setAttendance(setlistId, false, confirm === true)));
+}

package/dist/tools/resolve.js

@@ -14,6 +14,25 @@ function songCountOf(s) {
     const sets = Array.isArray(s.sets?.set) ? s.sets.set : [];
     return sets.reduce((n, set) => n + (Array.isArray(set?.song) ? set.song.length : 0), 0);
 }
+function songNamesOf(s) {
+    const sets = Array.isArray(s.sets?.set) ? s.sets.set : [];
+    const names = [];
+    for (const set of sets) {
+        for (const song of Array.isArray(set?.song) ? set.song : []) {
+            if (typeof song?.name === 'string')
+                names.push(song.name);
+        }
+    }
+    return names;
+}
+// Absolute day distance between two ISO dates; Infinity if either is unparseable.
+function daysApart(isoA, isoB) {
+    const a = isoA ? Date.parse(isoA) : NaN;
+    const b = isoB ? Date.parse(isoB) : NaN;
+    if (Number.isNaN(a) || Number.isNaN(b))
+        return Number.POSITIVE_INFINITY;
+    return Math.abs(a - b) / 86_400_000;
+}
 // Loosen punctuation/format variants for a fuzzy retry: drop quotes, turn + / &
 // into "and", drop stray periods, collapse whitespace. (Dan + Shay, "Weird Al"
 // Yankovic, DJ Pee .Wee.)
@@ -69,7 +88,46 @@ function pickBest(list, city, venue) {
     // Best location/song score wins; prefer a populated setlist on ties via songCount.
     return [...list].sort((a, b) => score(b, city, venue) - score(a, city, venue) || songCountOf(b) - songCountOf(a))[0];
 }
-async function resolveOne(req, c) {
+// When a show is an empty stub but the act toured a repeating set, find a
+// populated setlist from the SAME tour (setlist.fm only) to offer as a labeled
+// reference. Picks the populated date closest to the show. Returns undefined if
+// the stub has no tour or no other populated tour date exists.
+async function findTourReference(req, stub, targetDate) {
+    const tour = stub.tour?.name;
+    if (!tour)
+        return undefined;
+    const query = stub.artist?.mbid
+        ? { artistMbid: stub.artist.mbid, tourName: tour }
+        : { artistName: stub.artist?.name, tourName: tour };
+    // Without an artist, a tour-name-only search could return a different act on a
+    // same-named tour — don't guess.
+    if (!query.artistMbid && !query.artistName)
+        return undefined;
+    const candidates = (await searchSetlists(req, query)).filter((s) => s.id !== stub.id && songCountOf(s) > 0);
+    if (candidates.length === 0)
+        return undefined;
+    // Prefer a *representative* night: a setlist that's substantially complete
+    // relative to the tour's best-documented show (≥60%), so we don't surface
+    // another thin/partial entry just because it's the nearest date. Among those,
+    // pick the date closest to the target show.
+    // The best-documented night always passes its own threshold, so `substantial`
+    // is non-empty whenever `candidates` is.
+    const maxSongs = Math.max(...candidates.map(songCountOf));
+    const substantial = candidates.filter((s) => songCountOf(s) >= Math.max(1, maxSongs * 0.6));
+    const ref = [...substantial].sort((a, b) => daysApart(a.eventDate, targetDate) - daysApart(b.eventDate, targetDate) || songCountOf(b) - songCountOf(a))[0];
+    return {
+        note: `No songs are logged for this show on setlist.fm. This is the typical set for the "${tour}" tour, from a different date — verify before treating it as this exact show's setlist.`,
+        tour,
+        fromDate: ref.eventDate,
+        fromVenue: ref.venue?.name,
+        fromCity: ref.venue?.city?.name,
+        setlistId: ref.id,
+        url: ref.url,
+        songCount: songCountOf(ref),
+        songs: songNamesOf(ref),
+    };
+}
+async function resolveOne(req, c, tourFallback) {
     const filters = {
         date: isoToDmy(c.date),
         ...(c.city ? { cityName: c.city } : {}),
@@ -94,7 +152,7 @@ async function resolveOne(req, c) {
     if (!best)
         return { input: c, match: null, alternatives: 0 };
     const songCount = songCountOf(best);
-    return {
+    const result = {
         input: c,
         match: {
             setlistId: best.id,
@@ -109,6 +167,13 @@ async function resolveOne(req, c) {
         },
         alternatives: list.length - 1,
     };
+    // Empty stub: try to offer the tour's typical (populated) setlist as a labeled reference.
+    if (songCount === 0 && tourFallback) {
+        const ref = await findTourReference(req, best, c.date);
+        if (ref)
+            result.tourReference = ref;
+    }
+    return result;
 }
 const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 /**
@@ -123,6 +188,7 @@ export async function resolveConcerts(concerts, deps = {}) {
     const now = deps.now ?? Date.now;
     const paceMs = deps.paceMs ?? PACE_MS;
     const budgetMs = deps.budgetMs ?? BUDGET_MS;
+    const tourFallback = deps.tourFallback ?? true;
     // Gate every upstream call to at least `paceMs` apart (the first runs immediately).
     let lastCallAt = 0;
     const req = async (method, path, opts) => {
@@ -141,7 +207,7 @@ export async function resolveConcerts(concerts, deps = {}) {
             results.push({ input: c, match: null, alternatives: 0, pending: true });
             continue;
         }
-        results.push(await resolveOne(req, c));
+        results.push(await resolveOne(req, c, tourFallback));
     }
     return results;
 }
@@ -150,7 +216,15 @@ export function summarizeResults(results) {
     const pending = results.filter((r) => r.pending).length;
     const matched = results.filter((r) => r.match).length;
     const stubs = results.filter((r) => r.match && !r.match.hasSongs).length;
-    const summary = { total: results.length, matched, stubs, unmatched: results.length - matched - pending, pending };
+    const tourReferenced = results.filter((r) => r.tourReference).length;
+    const summary = {
+        total: results.length,
+        matched,
+        stubs,
+        tourReferenced,
+        unmatched: results.length - matched - pending,
+        pending,
+    };
     const payload = { results, summary };
     if (pending > 0) {
         payload.note = `Reached the time budget after ${results.length - pending} of ${results.length} concerts. Re-call setlist_resolve_concerts with just the ${pending} pending concert(s).`;
@@ -159,7 +233,7 @@ export function summarizeResults(results) {
 }
 export function registerResolveTools(server) {
     server.registerTool('setlist_resolve_concerts', {
-        description: "Resolve many concerts to their setlists in ONE call (instead of 2+ per show). Given up to 24 `{artist, date, city?, venue?}`, returns the best-match setlist for each — `{setlistId, url, eventDate, artist, venue, city, tour, songCount, hasSongs}` — plus a `{matched, stubs, unmatched, pending}` summary. For each: searches artist + date (narrowed by your city/venue), and on a miss falls back to a relevance artist lookup (by mbid) and a punctuation-normalized name so format variants still resolve. `hasSongs: false` flags an empty stub page. Calls are paced to setlist.fm's ~2 req/sec limit; if a big batch can't finish within the time budget the rest come back `pending: true` (re-call with just those) rather than timing out. Keep batches ≤24." +
+        description: "Resolve many concerts to their setlists in ONE call (instead of 2+ per show). Given up to 24 `{artist, date, city?, venue?}`, returns the best-match setlist for each — `{setlistId, url, eventDate, artist, venue, city, tour, songCount, hasSongs}` — plus a `{matched, stubs, tourReferenced, unmatched, pending}` summary. For each: searches artist + date (narrowed by your city/venue), and on a miss falls back to a relevance artist lookup (by mbid) and a punctuation-normalized name so format variants still resolve. `hasSongs: false` flags an empty stub page (no songs logged on setlist.fm). When a show is a stub, if the act toured a repeating set the result also includes a `tourReference` — a populated setlist from the SAME tour on a different date (with `songs` + its own `url`), clearly labeled as a reference, NOT this exact show (set `tourFallback: false` to skip these extra lookups). Calls are paced to setlist.fm's ~2 req/sec limit; if a big batch can't finish within the time budget the rest come back `pending: true` (re-call with just those) rather than timing out. Keep batches ≤24." +
             ATTRIBUTION_NOTE,
         annotations: { readOnlyHint: true },
         inputSchema: {
@@ -173,9 +247,13 @@ export function registerResolveTools(server) {
                 .min(1)
                 .max(MAX_BATCH)
                 .describe(`Concerts to resolve (1–${MAX_BATCH} per call)`),
+            tourFallback: z
+                .boolean()
+                .optional()
+                .describe('For empty stubs, also fetch a same-tour reference setlist (default true). Set false to skip the extra lookups.'),
         },
-    }, async ({ concerts }) => {
-        const results = await resolveConcerts(concerts);
+    }, async ({ concerts, tourFallback }) => {
+        const results = await resolveConcerts(concerts, { tourFallback });
         return textResult(summarizeResults(results));
     });
 }

package/dist/version.js

@@ -3,4 +3,4 @@
 // release-please-config.json's `extra-files`), and `versionSyncTest` guards
 // that it stays equal to package.json. Import VERSION wherever the version is
 // needed rather than re-declaring it.
-export const VERSION = '0.5.1'; // x-release-please-version
+export const VERSION = '0.6.1'; // x-release-please-version

package/dist/web-client.js

@@ -0,0 +1,100 @@
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+import { loadDotenvSafely, readEnvVar, createApiClient, messageOf } from '@chrischall/mcp-utils';
+// Load .env for local dev (guarded; the mcpb bundle omits dotenv).
+const __dirname = dirname(fileURLToPath(import.meta.url));
+await loadDotenvSafely({ path: join(__dirname, '..', '.env'), override: false });
+const RETRY_5XX = 3; // www.setlist.fm intermittently returns 500/502/503 from its gateway
+const RETRY_DELAY_MS = 1200;
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+// Retry transient gateway errors (502/503/504); createApiClient only retries 429.
+async function retryOn5xx(fn) {
+    let lastErr;
+    for (let attempt = 0; attempt <= RETRY_5XX; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            lastErr = err;
+            if (attempt < RETRY_5XX && /\b50[0234]\b/.test(messageOf(err))) {
+                await sleep(RETRY_DELAY_MS);
+                continue;
+            }
+            throw err;
+        }
+    }
+    throw lastErr;
+}
+const BASE_URL = 'https://www.setlist.fm';
+const SERVICE_NAME = 'setlist.fm (web)';
+const REQUEST_TIMEOUT_MS = 20_000;
+// A browser-like UA; the bare default can trip the site's bot heuristics.
+const USER_AGENT = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36';
+/**
+ * Authenticated client for the setlist.fm **website** (not the public REST API).
+ * The site has no JSON API for user actions — it's server-rendered HTML plus
+ * Apache Wicket stateful AJAX, authenticated by the logged-in session cookie.
+ *
+ * Auth resolves in order: `SETLIST_SESSION_COOKIE` (env) → a fetchproxy
+ * `read_cookies` bootstrap from the signed-in browser tab (lazy, optional) →
+ * a deferred config error at request time. Kept entirely separate from the
+ * api-key `SetlistClient` so the public-API tools never depend on a session.
+ */
+export class SetlistWebClient {
+    cookie;
+    configError;
+    api;
+    constructor() {
+        this.cookie = readEnvVar('SETLIST_SESSION_COOKIE') ?? null;
+        this.configError = new Error('No setlist.fm session: set SETLIST_SESSION_COOKIE (copy the Cookie header from a logged-in www.setlist.fm request) or connect the fetchproxy browser bridge.');
+        this.api = createApiClient({
+            baseUrl: BASE_URL,
+            serviceName: SERVICE_NAME,
+            timeout: REQUEST_TIMEOUT_MS,
+            retry: { count: 1, delayMs: 2000 },
+            baseHeaders: { 'User-Agent': USER_AGENT },
+        });
+    }
+    /**
+     * Resolve the session cookie: `SETLIST_SESSION_COOKIE` (env) first, else a
+     * one-time fetchproxy `read_cookies` grab from the signed-in tab (lazy-imported
+     * so the env path never loads the bridge), else the deferred config error.
+     * The grabbed cookie is cached on the instance for the process lifetime.
+     */
+    async requireCookie() {
+        if (this.cookie)
+            return this.cookie;
+        const { grabSessionCookie } = await import('./fetchproxy-cookie.js');
+        const grabbed = await grabSessionCookie();
+        if (grabbed) {
+            this.cookie = grabbed;
+            return grabbed;
+        }
+        throw this.configError;
+    }
+    /** GET a page as HTML, authenticated. `path` is appended to the www base URL. */
+    async fetchPage(path) {
+        const cookie = await this.requireCookie();
+        return retryOn5xx(() => this.api.fetchHtml('GET', path, { headers: { Cookie: cookie } }));
+    }
+    /**
+     * Replay an Apache Wicket AJAX behavior GET (e.g. the attendance toggle).
+     * `ajaxPath` is the per-render URL parsed from a page's `wicketAjaxGet(...)`;
+     * `baseUrl` is the rendering page's path (no leading slash) for the
+     * `Wicket-Ajax-BaseURL` header. Returns the `<ajax-response>` XML body.
+     */
+    async wicketAjaxGet(ajaxPath, baseUrl) {
+        const cookie = await this.requireCookie();
+        return retryOn5xx(() => this.api.fetchHtml('GET', ajaxPath, {
+            headers: {
+                Cookie: cookie,
+                'Wicket-Ajax': 'true',
+                'Wicket-Ajax-BaseURL': baseUrl,
+                'X-Requested-With': 'XMLHttpRequest',
+                Accept: 'text/xml, text/javascript, application/xml, text/html, */*',
+            },
+        }));
+    }
+}
+/** Module-level singleton (deferred-config: missing session surfaces at request time). */
+export const webClient = new SetlistWebClient();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "setlist-mcp",
-  "version": "0.5.1",
+  "version": "0.6.1",
   "mcpName": "io.github.chrischall/setlist-mcp",
   "description": "setlist.fm MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -35,7 +35,7 @@
   ],
   "scripts": {
     "build": "tsc && npm run bundle",
-    "bundle": "esbuild src/index.ts --bundle --platform=node --format=esm --external:dotenv --outfile=dist/bundle.js",
+    "bundle": "esbuild src/index.ts --bundle --platform=node --format=esm --external:dotenv --banner:js='import { createRequire as __createRequire } from \"module\"; const require = __createRequire(import.meta.url);' --outfile=dist/bundle.js",
     "dev": "node dist/index.js",
     "test": "vitest run",
     "test:watch": "vitest",
@@ -43,6 +43,8 @@
   },
   "dependencies": {
     "@chrischall/mcp-utils": "^0.6.0",
+    "@fetchproxy/bootstrap": "^1.3.1",
+    "@fetchproxy/server": "^1.3.1",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.0",
     "zod": "^4.4.2"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/setlist-mcp",
     "source": "github"
   },
-  "version": "0.5.1",
+  "version": "0.6.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "setlist-mcp",
-      "version": "0.5.1",
+      "version": "0.6.1",
       "transport": {
         "type": "stdio"
       },
@@ -29,6 +29,13 @@
           "isRequired": false,
           "format": "string",
           "isSecret": false
+        },
+        {
+          "name": "SETLIST_SESSION_COOKIE",
+          "description": "Optional. Logged-in www.setlist.fm Cookie header — enables the attendance write tools.",
+          "isRequired": false,
+          "format": "string",
+          "isSecret": true
         }
       ]
     }