splitwise-mcp 3.1.1 → 3.1.2

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Splitwise — natural-language expense and group management via the Splitwise API",
-    "version": "3.1.1"
+    "version": "3.1.2"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Splitwise",
       "source": "./",
       "description": "MCP server for Splitwise — manage expenses, groups, and friends via natural language",
-      "version": "3.1.1",
+      "version": "3.1.2",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "splitwise-mcp",
   "displayName": "Splitwise",
-  "version": "3.1.1",
+  "version": "3.1.2",
   "description": "MCP server for Splitwise — natural-language expense and group management via the Splitwise API",
   "author": {
     "name": "Chris Hall",

package/README.md

@@ -126,7 +126,7 @@ Add to Claude Desktop config:
 | `sw_get_current_user` | Get the authenticated user's profile |
 | `sw_healthcheck` | Verify the API key and Splitwise reachability; says which of the two failed |
 | `sw_get_user` | Get another user's profile by ID |
-| `sw_update_user` | Update the current user's profile fields |
+| `sw_update_user` | Update the current user's name, locale or default currency (login email and password are not changeable here) |
 
 ### Groups
 

package/dist/bundle.js

@@ -98340,6 +98340,25 @@ function redactAssetQuery(err, search) {
   if (message === err.message) return err;
   return err instanceof ApiError ? new ApiError(err.status, message) : new Error(message);
 }
+function flattenErrors(errors) {
+  if (errors == null) return [];
+  if (typeof errors === "string") return errors ? [errors] : [];
+  if (Array.isArray(errors)) return errors.flatMap((e2) => flattenErrors(e2));
+  if (typeof errors === "object") {
+    return Object.entries(errors).flatMap(
+      ([field, value]) => flattenErrors(value).map((msg) => field === "base" ? msg : `${field}: ${msg}`)
+    );
+  }
+  return [String(errors)];
+}
+function assertWriteSucceeded(data) {
+  if (data === null || typeof data !== "object" || Array.isArray(data)) return;
+  const record4 = data;
+  const messages = flattenErrors(record4.errors);
+  if (messages.length === 0 && record4.success !== false) return;
+  const detail = messages.length > 0 ? messages.join("; ") : "success: false with no error detail";
+  throw new Error(`Splitwise rejected the request: ${detail}`);
+}
 var SplitwiseClient = class {
   apiKey;
   /** Which source supplied the API key — a LABEL, never the value. */
@@ -98404,7 +98423,9 @@ var SplitwiseClient = class {
     return this.apiKey;
   }
   async request(method, path, body) {
-    return this.api.fetchJson(method, path, body !== void 0 ? { body } : {});
+    const data = await this.api.fetchJson(method, path, body !== void 0 ? { body } : {});
+    if (method.toUpperCase() !== "GET") assertWriteSucceeded(data);
+    return data;
   }
   /**
    * Fetch the raw bytes behind an absolute asset URL the API handed back (an
@@ -98588,34 +98609,36 @@ function registerUserTools(server, client2) {
   server.registerTool(
     "sw_update_user",
     {
-      description: "Update the current user's profile fields. id must be the current user's id.",
+      description: "Update the current user's profile fields: name, locale and default currency. id must be the current user's id. The login email and password are deliberately not settable here \u2014 account credentials are changed in the Splitwise app, not by an assistant.",
+      annotations: { readOnlyHint: false, destructiveHint: true },
+      // No `email` / `password`: changing the login email is an account
+      // takeover primitive (a password reset to the new address follows), and
+      // the only gate would be a model-set `confirm` that injected text from
+      // comments, notifications or receipts could talk it into (fleet-audit
+      // #250). z.object strips unknown keys, so a caller passing them anyway
+      // has them dropped before the request is built.
       inputSchema: external_exports.object({
         id: external_exports.number().describe("User ID (must be the current user's id)"),
         first_name: external_exports.string().optional(),
         last_name: external_exports.string().optional(),
-        email: external_exports.string().optional(),
-        password: external_exports.string().optional(),
         locale: external_exports.string().optional(),
         default_currency: external_exports.string().optional(),
         confirm: schemaConfirm
       })
     },
-    async ({ id, first_name, last_name, email: email4, password, locale, default_currency, confirm }) => {
+    async ({ id, first_name, last_name, locale, default_currency, confirm }) => {
       const body = pruneUndefined({
         first_name,
         last_name,
-        email: email4,
-        password,
         locale,
         default_currency
       });
-      const previewBody = { ...body, ...password !== void 0 ? { password: "[hidden]" } : {} };
       const gate = previewUnlessConfirmed(
         confirm,
         `Update current Splitwise user ${id} profile`,
         "POST",
         `/update_user/${id}`,
-        previewBody
+        body
       );
       if (gate) return gate;
       const data = await client2.request("POST", `/update_user/${id}`, body);
@@ -99487,7 +99510,7 @@ function registerUtilityTools(server, client2) {
 // src/index.ts
 await runMcp({
   name: "splitwise-mcp",
-  version: "3.1.1",
+  version: "3.1.2",
   // x-release-please-version
   deps: client,
   banner: "[splitwise-mcp] This project was developed and is maintained by AI (Claude Sonnet 4.6). Use at your own discretion.",

package/dist/client.js

@@ -59,6 +59,37 @@ function redactAssetQuery(err, search) {
         return err;
     return err instanceof ApiError ? new ApiError(err.status, message) : new Error(message);
 }
+/** Flatten Splitwise's `errors` value (`{field: [msg]}`, `[msg]` or a string) into messages. */
+function flattenErrors(errors) {
+    if (errors == null)
+        return [];
+    if (typeof errors === 'string')
+        return errors ? [errors] : [];
+    if (Array.isArray(errors))
+        return errors.flatMap((e) => flattenErrors(e));
+    if (typeof errors === 'object') {
+        return Object.entries(errors).flatMap(([field, value]) => flattenErrors(value).map((msg) => (field === 'base' ? msg : `${field}: ${msg}`)));
+    }
+    return [String(errors)];
+}
+/**
+ * Splitwise answers a failed write with HTTP 200, not an error status:
+ * create/update return `{expenses: [], errors: {...}}` and delete/undelete
+ * return `{success: false, errors: {...}}`. `fetchJson` only throws on
+ * non-2xx, so without this check a rejected write reaches the tool as an
+ * ordinary result and reads as "created"/"deleted". Throwing here makes every
+ * write tool report it with `isError`.
+ */
+function assertWriteSucceeded(data) {
+    if (data === null || typeof data !== 'object' || Array.isArray(data))
+        return;
+    const record = data;
+    const messages = flattenErrors(record.errors);
+    if (messages.length === 0 && record.success !== false)
+        return;
+    const detail = messages.length > 0 ? messages.join('; ') : 'success: false with no error detail';
+    throw new Error(`Splitwise rejected the request: ${detail}`);
+}
 export class SplitwiseClient {
     apiKey;
     /** Which source supplied the API key — a LABEL, never the value. */
@@ -138,7 +169,10 @@ export class SplitwiseClient {
         return this.apiKey;
     }
     async request(method, path, body) {
-        return this.api.fetchJson(method, path, body !== undefined ? { body } : {});
+        const data = await this.api.fetchJson(method, path, body !== undefined ? { body } : {});
+        if (method.toUpperCase() !== 'GET')
+            assertWriteSucceeded(data);
+        return data;
     }
     /**
      * Fetch the raw bytes behind an absolute asset URL the API handed back (an

package/dist/index.js

@@ -19,7 +19,7 @@ import { registerUtilityTools } from './tools/utilities.js';
 // client into the same registrars instead of this singleton.
 await runMcp({
     name: 'splitwise-mcp',
-    version: '3.1.1', // x-release-please-version
+    version: '3.1.2', // x-release-please-version
     deps: client,
     banner: '[splitwise-mcp] This project was developed and is maintained by AI (Claude Sonnet 4.6). Use at your own discretion.',
     tools: [

package/dist/tools/user.js

@@ -25,29 +25,30 @@ export function registerUserTools(server, client) {
         return minifiedResult(viewUser(resolveView(view, SW_VIEWS), data));
     });
     server.registerTool('sw_update_user', {
-        description: "Update the current user's profile fields. id must be the current user's id.",
+        description: "Update the current user's profile fields: name, locale and default currency. id must be the current user's id. The login email and password are deliberately not settable here — account credentials are changed in the Splitwise app, not by an assistant.",
+        annotations: { readOnlyHint: false, destructiveHint: true },
+        // No `email` / `password`: changing the login email is an account
+        // takeover primitive (a password reset to the new address follows), and
+        // the only gate would be a model-set `confirm` that injected text from
+        // comments, notifications or receipts could talk it into (fleet-audit
+        // #250). z.object strips unknown keys, so a caller passing them anyway
+        // has them dropped before the request is built.
         inputSchema: z.object({
             id: z.number().describe("User ID (must be the current user's id)"),
             first_name: z.string().optional(),
             last_name: z.string().optional(),
-            email: z.string().optional(),
-            password: z.string().optional(),
             locale: z.string().optional(),
             default_currency: z.string().optional(),
             confirm: schemaConfirm,
         }),
-    }, async ({ id, first_name, last_name, email, password, locale, default_currency, confirm }) => {
+    }, async ({ id, first_name, last_name, locale, default_currency, confirm }) => {
         const body = pruneUndefined({
             first_name,
             last_name,
-            email,
-            password,
             locale,
             default_currency,
         });
-        // Never echo the password in the dry-run preview.
-        const previewBody = { ...body, ...(password !== undefined ? { password: '[hidden]' } : {}) };
-        const gate = previewUnlessConfirmed(confirm, `Update current Splitwise user ${id} profile`, 'POST', `/update_user/${id}`, previewBody);
+        const gate = previewUnlessConfirmed(confirm, `Update current Splitwise user ${id} profile`, 'POST', `/update_user/${id}`, body);
         if (gate)
             return gate;
         const data = await client.request('POST', `/update_user/${id}`, body);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "splitwise-mcp",
-  "version": "3.1.1",
+  "version": "3.1.2",
   "mcpName": "io.github.chrischall/splitwise-mcp",
   "description": "Splitwise MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/splitwise-mcp",
     "source": "github"
   },
-  "version": "3.1.1",
+  "version": "3.1.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "splitwise-mcp",
-      "version": "3.1.1",
+      "version": "3.1.2",
       "transport": {
         "type": "stdio"
       },