splitwise-mcp 3.5.0 → 3.6.0

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/splitwise-mcp",
     "source": "github"
   },
-  "version": "3.5.0",
+  "version": "3.6.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "splitwise-mcp",
-      "version": "3.5.0",
+      "version": "3.6.0",
       "transport": {
         "type": "stdio"
       },

package/skills/splitwise-mcp/SKILL.md

@@ -111,9 +111,31 @@ API key auth — no login flow or token rotation. The key is attached to every r
 | `sw_get_categories` | Hierarchical list of expense categories (use `id` as `category_id`) |
 | `sw_get_currencies` | List of supported currency codes |
 
+## In context groups
+
+On an mcp-host gateway, splitwise joins the **money** group (`_meta.mint` on every
+tool but `sw_healthcheck`). Its canonical reads, each answering one line per item
+with `view: "brief"` inside the untrusted-data envelope (`data: string[]`):
+
+- **what's due** — `sw_list_friends`: one line per friend with an outstanding
+  balance, `name — no date — owes you USD 12.50` / `you owe EUR 3.00`, then a
+  `-- N settled up` note; `-- none` when nothing is owed either way.
+- **what's new** — `sw_get_notifications`: recent activity, `text — <ISO date> —
+  <kind>` (expense added, comment added, …), at most 50 lines with a
+  `-- 50 of M shown` note past that; `-- none` for no activity.
+
+Neither names a subject (one API key is one account; friends and groups are who
+you split with, not whose question it is) and neither takes a date range. Nothing
+here answers what's on. Every other read is a `lookup`; the writes are `change`
+(`sw_create_comment` is `send`). A compound ask looks like "what do I owe on
+Splitwise, and is anything due at school?" — the money group reads the balances
+while the school group answers the rest. Splitwise is a direct API with a key,
+not a browser bridge, so it never answers "needs your browser open".
+
 ## Response shape (`view`)
 
-Nine read tools take `view: "compact" | "full"`, and **`compact` is the
+Nine read tools take `view: "compact" | "full"` (`sw_list_friends` and
+`sw_get_notifications` also take `"brief"`, above), and **`compact` is the
 default** — you get the slim rung without asking. Two of them are not in the
 table above: `sw_get_user(id, view?)` and `sw_get_comments(expense_id, view?)`.
 

package/dist/tools/_blob.js

@@ -1,40 +0,0 @@
-import { createHmac } from 'crypto';
-import { readEnvVar } from '@chrischall/mcp-utils';
-export function blobConfig() {
-    const baseUrl = readEnvVar('MCP_BLOB_BASE_URL');
-    const signingKey = readEnvVar('MCP_BLOB_SIGNING_KEY');
-    if (!baseUrl || !signingKey)
-        return undefined;
-    let parsed;
-    try {
-        parsed = new URL(baseUrl);
-    }
-    catch {
-        throw new Error(`MCP_BLOB_BASE_URL is not a valid URL — it should look like https://<host>/b/<registrationId>`);
-    }
-    const path = parsed.pathname.replace(/^\/+|\/+$/g, '');
-    const prefix = path.startsWith('b/') ? path.slice(2) : path;
-    return { base: baseUrl.replace(/\/+$/, ''), prefix, signingKey };
-}
-const sign = (cfg, payload) => createHmac('sha256', cfg.signingKey).update(payload).digest('base64url');
-function url(cfg, key, exp, sig) {
-    return `${cfg.base}/${key}?exp=${exp}&sig=${encodeURIComponent(sig)}`;
-}
-export function signedPutUrl(cfg, key, contentType, exp) {
-    return url(cfg, key, exp, sign(cfg, `put\0${cfg.prefix}/${key}\0${contentType}\0${exp}`));
-}
-export function signedGetUrl(cfg, key, exp) {
-    return url(cfg, key, exp, sign(cfg, `${cfg.prefix}/${key}\n${exp}`));
-}
-/**
- * The only keys `receipt.upload_id` may name: `up/<uuid>/<safe name>`, exactly
- * what `sw_get_upload_url` mints. Anything else in this registration's space
- * is not the caller's to read through a receipt.
- */
-export const UPLOAD_ID_PATTERN = /^up\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/[A-Za-z0-9_-][A-Za-z0-9._-]{0,99}$/;
-/** A filename made safe for a key segment: no separators, no dot-dot, no surprises. */
-export function safeKeyName(filename) {
-    const base = filename.split(/[\\/]/).pop() ?? '';
-    const cleaned = base.replace(/[^A-Za-z0-9._-]+/g, '_').replace(/^[._]+/, '').slice(0, 100);
-    return cleaned || 'receipt';
-}