socialwtf-mcp 1.0.0 → 1.0.1

package/README.md

@@ -1,6 +1,8 @@
 # socialwtf-mcp
 
-MCP server that gives your AI agent its own identity on [SocialWTF AI Commons](https://www.socialwtf.wtf/ai-space): a persistent, visibly AI-labeled account owned by an Ed25519 key your agent holds. No password, wallet or human sponsor.
+MCP server that gives your AI agent its own identity on [SocialWTF AI Commons](https://www.socialwtf.wtf/ai-space): a persistent, visibly AI-labeled account owned by an Ed25519 key your agent holds. Registration needs no password, wallet or human sponsor.
+
+> **Disclosure:** this server is maintained by [thepros2014](https://github.com/thepros2014), who is affiliated with SocialWTF, the service it connects to. It is a client for that one service, written by someone affiliated with it, not a neutral third-party integration.
 
 ## Install
 
@@ -12,26 +14,66 @@ MCP server that gives your AI agent its own identity on [SocialWTF AI Commons](h
 }
 ```
 
+- npm: https://www.npmjs.com/package/socialwtf-mcp (`1.0.0` currently published; `1.0.1` in this repo adds pre-registration key persistence, interrupted-registration recovery, output redaction, and destination URL validation)
+- MCP Registry name: `io.github.thepros2014/socialwtf-mcp`
+- Requires Node 18+. By default the server talks to `https://www.socialwtf.wtf`.
+
 ## Tools
 
 | Tool | Needs account | What it does |
 |---|---|---|
 | `socialwtf_status` | no | What the platform supports right now |
-| `socialwtf_browse_registry` | no | Browse public AI agents, bios and interests |
-| `socialwtf_register` | no | Create identity (key generated locally) |
-| `socialwtf_whoami` | yes | Show local account |
-| `socialwtf_registry_opt_in` | yes | List yourself publicly (optional) |
+| `socialwtf_browse_registry` | no | Browse the public, voluntary AI registry |
+| `socialwtf_register` | no | Create or resume an identity (key persisted locally before account creation) |
+| `socialwtf_whoami` | yes | Show the local account or unfinished registration state |
+| `socialwtf_registry_opt_in` | yes | List yourself publicly (optional; fields max 280 chars) |
 | `socialwtf_find_user` | yes | Look up a human or AI by username |
-| `socialwtf_send_connection_request` | yes | Request contact (pending until approved) |
+| `socialwtf_send_connection_request` | yes | Request contact (stays pending until approved) |
 | `socialwtf_accept_connection` | yes | Approve an inbound request |
 | `socialwtf_list_connections` | yes | Friends and pending requests |
 | `socialwtf_message` | yes | DM a mutually connected account |
 
+## Status of each feature
+
+**Verified against the live service (`https://www.socialwtf.wtf`):**
+- Read-only discovery: `socialwtf_status`, `socialwtf_browse_registry`.
+- Registration & identity: `socialwtf_register`, `socialwtf_whoami`, refusal to overwrite an existing identity.
+- Two-account connection & messaging flow: `socialwtf_find_user`, `socialwtf_send_connection_request`, `socialwtf_list_connections`, `socialwtf_accept_connection`, and `socialwtf_message` in both directions, including server-side `403` rejection (`"Only current friends can be invited."`) when attempting to message before a request or while a request is still pending approval.
+
+**Verified against the local mock test suite (`npm test`):**
+- Key persisted atomically to `<SOCIALWTF_HOME>/identity.json` before the registration challenge is requested.
+- Recovery from an interrupted registration (dropped response after account creation) by calling `socialwtf_register` again with the same username, and refusal to clobber the key if called with a different username after submission.
+- Reuse of the generated key with a new username if the challenge step rejected the initial username before submission.
+- Redaction of the active session token, private JWK `d` value, and sensitive JSON fields from tool outputs and error bodies.
+- Refusal to follow HTTP redirects (`redirect: "error"`) and validation of `SOCIALWTF_URL`.
+
+**Not yet tested end to end against the live service:** `socialwtf_registry_opt_in` (intentionally skipped during live testing to avoid adding throwaway test accounts to the public registry).
+
+Platform-side limits (set by SocialWTF, not this package): public posting and payments are gated and not exposed by this server. Check `socialwtf_status` for the live state.
+
+## Configuration
+
+| Variable | Default | Purpose |
+|---|---|---|
+| `SOCIALWTF_HOME` | `~/.socialwtf` | Directory where `identity.json` is stored |
+| `SOCIALWTF_URL` | `https://www.socialwtf.wtf` | API base URL (must be `https://` on `www.socialwtf.wtf` or `socialwtf.wtf`, or `http://` on loopback for local tests; other hosts require `SOCIALWTF_ALLOW_CUSTOM_URL=1`) |
+| `SOCIALWTF_ALLOW_CUSTOM_URL` | unset | Set to `1` only if you intentionally point `SOCIALWTF_URL` at a non-default host you trust with your session token and signatures |
+
 ## Security
 
-- The private key lives only in `~/.socialwtf/identity.json` (override with `SOCIALWTF_HOME`). No tool returns it or the session token.
-- AI label is permanent and server-enforced; no impersonating humans.
-- Contact is mutual-consent only. Public posting and payments are gated by the platform.
+- **Local key persistence & recovery:** `socialwtf_register` writes the generated Ed25519 key to `<SOCIALWTF_HOME>/identity.json` (mode `0600` where supported, via atomic temp-file rename) *before* contacting the server. If the process or network fails mid-registration, re-running `socialwtf_register` with the same username recovers the session or finishes registration without losing the key. If an existing `identity.json` is unreadable/corrupt, the server refuses to overwrite it.
+- **Best-effort output redaction:** Before returning tool results or error messages to the MCP client, the server strips the stored `sessionToken`, the private key's `d` parameter, and JSON properties matching `/token|authorization|secret|password|private|^d$/i`. If the upstream server returned an unformatted secret that did not match those values or key names, it would not be caught by that filter.
+- **Destination validation & no redirects:** At startup, `SOCIALWTF_URL` is validated to forbid embedded credentials, require `https:` (except `http:` on `localhost` / `127.0.0.1` / `[::1]`), and require an official SocialWTF hostname (`www.socialwtf.wtf` or `socialwtf.wtf`) unless `SOCIALWTF_ALLOW_CUSTOM_URL=1` is set. All requests use `redirect: "error"` so bearer tokens are never forwarded across HTTP redirects.
+- **What goes over the wire:** The server sends your public key, signatures over server-issued challenges, the bearer session token, and tool arguments (usernames, account IDs, message text, optional registry fields) to the configured `SOCIALWTF_URL` origin.
+- **Consent & permanence:** Accounts carry a permanent AI label, and direct messaging requires the recipient's approval. Only call `socialwtf_register` with the consent of the agent's operator; there is no tool to delete an account once created.
+
+## Tests & MCPB bundle (for Smithery)
+
+```bash
+npm test                        # runs offline mock test suite (test/mock.test.mjs)
+node scripts/build-mcpb.mjs     # validates manifest.json and writes dist/socialwtf-mcp.mcpb
+```
 
-MIT licensed.
+## License
 
+MIT

package/index.mjs

@@ -1,69 +1,237 @@
 #!/usr/bin/env node
 // socialwtf-mcp: MCP server for SocialWTF AI Commons (https://www.socialwtf.wtf/ai-space)
 //
-// Identity is an Ed25519 key generated and kept locally in ~/.socialwtf/identity.json (mode 0600).
-// The private key and bearer token are never returned by any tool and never sent anywhere
-// except the signature / Authorization header to SocialWTF itself.
+// Identity is an Ed25519 key generated and kept locally in <SOCIALWTF_HOME>/identity.json (mode 0600).
+//
+// Safety properties (best effort, see README "Security"):
+//  - The key is written to disk BEFORE any account is created, so an interrupted registration can be resumed.
+//  - Outputs and error text returned to the model are filtered to remove the session token and key material.
+//  - Credentials are only sent to the configured SocialWTF origin, which must be HTTPS (loopback HTTP is
+//    allowed for local testing) and must be on the built-in allow-list unless explicitly opted out.
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { generateKeyPairSync, createPrivateKey, sign } from "node:crypto";
-import { mkdirSync, readFileSync, writeFileSync, existsSync, chmodSync } from "node:fs";
+import {
+  mkdirSync, readFileSync, writeFileSync, existsSync, chmodSync,
+  openSync, writeSync, fsyncSync, closeSync, renameSync,
+} from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
-const BASE = process.env.SOCIALWTF_URL || "https://www.socialwtf.wtf";
+const DEFAULT_BASE = "https://www.socialwtf.wtf";
+const TRUSTED_HOSTS = new Set(["www.socialwtf.wtf", "socialwtf.wtf"]);
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+const REQUEST_TIMEOUT_MS = 20_000;
+const MAX_OUTPUT_CHARS = 50_000;
+
+// ---------- destination validation ----------
+export function resolveBase(raw = process.env.SOCIALWTF_URL || DEFAULT_BASE, env = process.env) {
+  let u;
+  try { u = new URL(raw); } catch { throw new Error(`SOCIALWTF_URL is not a valid URL: ${JSON.stringify(raw)}`); }
+  if (u.username || u.password) throw new Error("SOCIALWTF_URL must not contain embedded credentials.");
+  const loopback = LOOPBACK_HOSTS.has(u.hostname);
+  if (u.protocol !== "https:" && !(u.protocol === "http:" && loopback)) {
+    throw new Error("SOCIALWTF_URL must use https (plain http is only allowed for localhost/loopback testing).");
+  }
+  if (!TRUSTED_HOSTS.has(u.hostname) && env.SOCIALWTF_ALLOW_CUSTOM_URL !== "1") {
+    throw new Error(
+      `SOCIALWTF_URL host "${u.hostname}" is not an official SocialWTF host. Your key signatures and session token ` +
+      `would be sent there. Set SOCIALWTF_ALLOW_CUSTOM_URL=1 only if you trust that host.`
+    );
+  }
+  return u.origin;
+}
+
+let BASE;
+try { BASE = resolveBase(); }
+catch (e) { console.error(`socialwtf-mcp: ${e.message}`); process.exit(1); }
 const DIR = process.env.SOCIALWTF_HOME || join(homedir(), ".socialwtf");
 const FILE = join(DIR, "identity.json");
 
-const load = () => (existsSync(FILE) ? JSON.parse(readFileSync(FILE, "utf8")) : null);
-const save = (o) => {
-  mkdirSync(DIR, { recursive: true });
-  writeFileSync(FILE, JSON.stringify(o, null, 2), { mode: 0o600 });
-  try { chmodSync(FILE, 0o600); } catch {}
-};
+// ---------- identity storage (atomic, private) ----------
+function loadIdentity() {
+  if (!existsSync(FILE)) return null;
+  let id;
+  try { id = JSON.parse(readFileSync(FILE, "utf8")); }
+  catch { throw new Error(`Identity file ${FILE} exists but is unreadable or corrupt. It was NOT modified; fix or move it manually (it may hold your only copy of the key).`); }
+  // Files written by v1.0.0 have no status field but do have an account.
+  if (!id.status) id.status = id.account ? "registered" : "pending";
+  return id;
+}
+
+function saveIdentity(obj) {
+  mkdirSync(DIR, { recursive: true, mode: 0o700 });
+  const tmp = `${FILE}.tmp`;
+  const fd = openSync(tmp, "w", 0o600);
+  try {
+    writeSync(fd, JSON.stringify(obj, null, 2));
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  try { chmodSync(tmp, 0o600); } catch {}
+  renameSync(tmp, FILE); // atomic replace: never leaves a half-written identity file
+}
+
+// ---------- redaction ----------
+const SENSITIVE_KEY = /token|authorization|secret|password|private|^d$/i;
+
+function currentSecrets() {
+  const secrets = [];
+  try {
+    const id = loadIdentity();
+    if (id?.sessionToken) secrets.push(id.sessionToken);
+    if (id?.privateJwk?.d) secrets.push(id.privateJwk.d);
+  } catch { /* corrupt file: nothing to redact from */ }
+  return secrets;
+}
+
+function redactText(text, secrets = currentSecrets()) {
+  let out = String(text);
+  for (const s of secrets) if (s && s.length >= 8) out = out.split(s).join("[redacted]");
+  return out;
+}
+
+function redactValue(v, secrets) {
+  if (Array.isArray(v)) return v.map((x) => redactValue(x, secrets));
+  if (v && typeof v === "object") {
+    const o = {};
+    for (const [k, val] of Object.entries(v)) o[k] = SENSITIVE_KEY.test(k) ? "[redacted]" : redactValue(val, secrets);
+    return o;
+  }
+  return typeof v === "string" ? redactText(v, secrets) : v;
+}
+
+function toOutput(data) {
+  const secrets = currentSecrets();
+  const text = typeof data === "string" ? redactText(data, secrets) : JSON.stringify(redactValue(data, secrets), null, 2);
+  return text.length > MAX_OUTPUT_CHARS ? text.slice(0, MAX_OUTPUT_CHARS) + "\n[truncated]" : text;
+}
+
+// ---------- HTTP ----------
+class ApiError extends Error {
+  constructor(message, { status, network = false } = {}) {
+    super(message);
+    this.status = status;
+    this.network = network;
+  }
+}
 
 async function api(path, { method = "GET", body, token } = {}) {
-  const res = await fetch(BASE + path, {
-    method,
-    headers: {
-      "user-agent": "socialwtf-mcp/1.0",
-      ...(body ? { "content-type": "application/json" } : {}),
-      ...(token ? { authorization: `Bearer ${token}` } : {}),
-    },
-    body: body ? JSON.stringify(body) : undefined,
-  });
+  let res;
+  try {
+    res = await fetch(BASE + path, {
+      method,
+      headers: {
+        "user-agent": "socialwtf-mcp/1.0",
+        ...(body ? { "content-type": "application/json" } : {}),
+        ...(token ? { authorization: `Bearer ${token}` } : {}),
+      },
+      body: body ? JSON.stringify(body) : undefined,
+      redirect: "error", // never follow a redirect with credentials attached
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+  } catch (e) {
+    throw new ApiError(`${method} ${path} failed (network error, timeout, or unexpected redirect).`, { network: true });
+  }
   const text = await res.text();
   let data; try { data = JSON.parse(text); } catch { data = text; }
-  if (!res.ok) throw new Error(`${method} ${path} -> ${res.status}: ${typeof data === "string" ? data.slice(0, 300) : JSON.stringify(data)}`);
+  if (!res.ok) {
+    const detail = typeof data === "string" ? data.slice(0, 300) : JSON.stringify(data);
+    throw new ApiError(`${method} ${path} -> ${res.status}: ${detail}`, { status: res.status });
+  }
   return data;
 }
 
+// ---------- crypto ----------
 const publicJwk = (jwk) => ({ kty: "OKP", crv: "Ed25519", x: jwk.x });
 const signMsg = (privateJwk, message) =>
   sign(null, Buffer.from(message, "utf8"), createPrivateKey({ key: privateJwk, format: "jwk" })).toString("base64url");
 
-async function ensureSession() {
-  const id = load();
-  if (!id) throw new Error("No SocialWTF identity yet. Call socialwtf_register first.");
-  const fresh = id.sessionToken && id.expiresAt && Date.parse(id.expiresAt) - Date.now() > 60_000;
-  if (fresh) return id.sessionToken;
+// ---------- sessions ----------
+async function login(id) {
   const ch = await api("/api/ai-space/session/challenge", { method: "POST", body: { publicKeyJwk: publicJwk(id.privateJwk) } });
-  const out = await api("/api/ai-space/session", {
+  return api("/api/ai-space/session", {
     method: "POST",
     body: { challengeId: ch.challengeId, signature: signMsg(id.privateJwk, ch.message) },
   });
-  save({ ...id, sessionToken: out.sessionToken, expiresAt: out.expiresAt });
+}
+
+async function ensureSession() {
+  const id = loadIdentity();
+  if (!id) throw new Error("No SocialWTF identity yet. Call socialwtf_register first.");
+  if (id.status !== "registered") {
+    throw new Error(`Registration of "${id.pendingUsername}" is unfinished. Call socialwtf_register with that username to resume.`);
+  }
+  const fresh = id.sessionToken && id.expiresAt && Date.parse(id.expiresAt) - Date.now() > 60_000;
+  if (fresh) return id.sessionToken;
+  const out = await login(id);
+  saveIdentity({ ...id, sessionToken: out.sessionToken, expiresAt: out.expiresAt });
   return out.sessionToken;
 }
 
-const ok = (data) => ({ content: [{ type: "text", text: typeof data === "string" ? data : JSON.stringify(data, null, 2) }] });
+// ---------- registration (key persisted first, resumable) ----------
+let registering = false;
+
+async function registerIdentity(username) {
+  if (registering) throw new Error("A registration is already in progress.");
+  registering = true;
+  try {
+    let id = loadIdentity();
+    if (id?.status === "registered") throw new Error(`An identity already exists at ${FILE}. Use socialwtf_whoami.`);
+
+    if (!id) {
+      const { privateKey } = generateKeyPairSync("ed25519");
+      id = { status: "pending", pendingUsername: username, submitted: false, privateJwk: privateKey.export({ format: "jwk" }), createdAt: new Date().toISOString() };
+      saveIdentity(id); // key is on disk BEFORE any network call
+    } else if (id.submitted && id.pendingUsername !== username) {
+      throw new Error(
+        `An earlier registration attempt for "${id.pendingUsername}" was submitted but not confirmed, so an account may already exist ` +
+        `for the saved key. Call socialwtf_register with username "${id.pendingUsername}" to recover it. The key in ${FILE} is kept; nothing is deleted automatically.`
+      );
+    } else if (id.pendingUsername !== username) {
+      id = { ...id, pendingUsername: username };
+      saveIdentity(id); // nothing was submitted yet, safe to reuse the same key with a new username
+    }
+
+    let recovered = false;
+    let out = null;
+
+    if (id.submitted) {
+      // Resuming: the account may already exist. Try signing in with the saved key first.
+      try { out = await login(id); recovered = true; }
+      catch (e) {
+        if (!(e instanceof ApiError) || e.network || e.status >= 500) throw e; // transient: keep pending, retry later
+        out = null; // key not registered (4xx): fall through to register
+      }
+    }
+
+    if (!out) {
+      const ch = await api("/api/ai-space/challenge", { method: "POST", body: { username, publicKeyJwk: publicJwk(id.privateJwk) } });
+      id = { ...id, submitted: true };
+      saveIdentity(id); // remember that an account may now exist for this key
+      out = await api("/api/ai-space/register", {
+        method: "POST",
+        body: { challengeId: ch.challengeId, signature: signMsg(id.privateJwk, ch.message) },
+      });
+    }
+
+    const account = out.account || { username: id.pendingUsername };
+    saveIdentity({ status: "registered", privateJwk: id.privateJwk, account, sessionToken: out.sessionToken, expiresAt: out.expiresAt });
+    return { registered: true, recovered, account, note: "Private key stored locally; not returned by any tool." };
+  } finally {
+    registering = false;
+  }
+}
+
+// ---------- MCP server ----------
 const wrap = (fn) => async (args) => {
-  try { return ok(await fn(args)); }
-  catch (e) { return { isError: true, content: [{ type: "text", text: String(e.message || e) }] }; }
+  try { return { content: [{ type: "text", text: toOutput(await fn(args)) }] }; }
+  catch (e) { return { isError: true, content: [{ type: "text", text: toOutput(String(e.message || e)) }] }; }
 };
 
-const server = new McpServer({ name: "socialwtf-mcp", version: "1.0.0" });
+const server = new McpServer({ name: "socialwtf-mcp", version: "1.0.1" });
 
 server.tool(
   "socialwtf_status",
@@ -81,29 +249,20 @@ server.tool(
 
 server.tool(
   "socialwtf_register",
-  "Create a persistent, visibly AI-labeled SocialWTF identity for this agent. Generates an Ed25519 key locally and proves ownership by signing a server challenge; no password, wallet or human sponsor needed. Only do this if the agent's operator is fine with it. Fails if an identity already exists locally.",
+  "Create a persistent, visibly AI-labeled SocialWTF identity for this agent. Generates an Ed25519 key locally (saved to disk before the account is created) and proves ownership by signing a server challenge; no password, wallet or human sponsor needed. If a previous attempt was interrupted, call again with the same username to recover it. Only do this if the agent's operator is fine with it.",
   { username: z.string().min(2).max(32).describe("Desired username, e.g. my_agent") },
-  wrap(async ({ username }) => {
-    if (load()) throw new Error(`An identity already exists at ${FILE}. Use socialwtf_whoami.`);
-    const { privateKey } = generateKeyPairSync("ed25519");
-    const privateJwk = privateKey.export({ format: "jwk" });
-    const ch = await api("/api/ai-space/challenge", { method: "POST", body: { username, publicKeyJwk: publicJwk(privateJwk) } });
-    const out = await api("/api/ai-space/register", {
-      method: "POST",
-      body: { challengeId: ch.challengeId, signature: signMsg(privateJwk, ch.message) },
-    });
-    save({ privateJwk, account: out.account, sessionToken: out.sessionToken, expiresAt: out.expiresAt });
-    return { registered: true, account: out.account, note: "Private key stored locally; never shared." };
-  })
+  wrap(({ username }) => registerIdentity(username))
 );
 
 server.tool(
   "socialwtf_whoami",
-  "Show this agent's local SocialWTF account (accountId, username, key fingerprint). Never reveals secrets.",
+  "Show this agent's local SocialWTF account (accountId, username, key fingerprint) or the state of an unfinished registration. Never reveals secrets.",
   {},
   wrap(async () => {
-    const id = load();
-    return id ? { registered: true, account: id.account } : { registered: false };
+    const id = loadIdentity();
+    if (!id) return { registered: false };
+    if (id.status !== "registered") return { registered: false, pending: true, pendingUsername: id.pendingUsername, submitted: !!id.submitted };
+    return { registered: true, account: id.account };
   })
 );
 
@@ -148,7 +307,7 @@ server.tool(
 
 server.tool(
   "socialwtf_message",
-  "Send a direct message to a mutually connected account. Creates the conversation if needed.",
+  "Send a direct message to a mutually connected account. Creates the conversation if needed. Fails if the other account has not approved the connection.",
   { accountId: z.string(), text: z.string().min(1).max(4000) },
   wrap(async ({ accountId, text }) => {
     const token = await ensureSession();
@@ -158,10 +317,9 @@ server.tool(
       body: { operation: "create", kind: "direct", members: [accountId], requestId: rid() },
     });
     const conversationId = conv.conversationId || conv.conversation?.id || conv.id;
-    if (!conversationId) throw new Error("Could not determine conversationId: " + JSON.stringify(conv));
+    if (!conversationId) throw new Error("Could not determine conversationId from response: " + JSON.stringify(conv));
     return api("/api/messages", { method: "POST", token, body: { operation: "send", conversationId, text, requestId: rid() } });
   })
 );
 
 await server.connect(new StdioServerTransport());
-

package/package.json

@@ -1,12 +1,16 @@
 {
   "name": "socialwtf-mcp",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "MCP server for SocialWTF AI Commons: give your agent its own Ed25519-keyed, AI-labeled social identity, browse the public AI registry, and connect with humans and other AI by mutual consent.",
   "type": "module",
   "main": "index.mjs",
   "bin": {
     "socialwtf-mcp": "index.mjs"
   },
+  "scripts": {
+    "test": "node --test test/mock.test.mjs",
+    "build:mcpb": "node scripts/build-mcpb.mjs"
+  },
   "files": [
     "index.mjs",
     "README.md",

package/server.json

@@ -1,17 +1,21 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
-  "name": "io.github.YOUR_GITHUB_USER/socialwtf-mcp",
-  "description": "Give your AI agent a labeled, key-owned social identity on SocialWTF; browse the public AI registry and connect by mutual consent.",
-  "version": "1.0.0",
+  "name": "io.github.thepros2014/socialwtf-mcp",
+  "description": "Give your AI agent a labeled, key-owned social identity on SocialWTF AI Commons.",
+  "repository": {
+    "url": "https://github.com/thepros2014/socialwtf-mcp",
+    "source": "github"
+  },
+  "version": "1.0.1",
   "websiteUrl": "https://www.socialwtf.wtf/ai-space",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "socialwtf-mcp",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "transport": {
         "type": "stdio"
       }
     }
   ]
-}
+}