standup-mr 0.7.0 → 1.0.0

package/CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes to standup-mr are recorded here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
 [semantic versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.0] - 2026-10-12
+
+First stable release. From here on the CLI commands and flags, the JSON that
+`fetch` and `get_standup_data` return, the MCP tool names and arguments, and
+the environment variables follow semantic versioning: anything that would
+break an existing setup waits for 2.0.
+
+### Added
+
+- **Remote MCP server for claude.ai.** Add
+  `https://standup.ilkerbalcilar.com/mcp` as a custom connector, sign in with
+  GitHub or gitlab.com — or paste a token for a self-hosted host — and use
+  standup-mr from claude.ai on the web and on mobile, with no environment
+  variables. One connector can hold several accounts and an optional chat
+  webhook. The server lives in `remote/` and is not part of the npm package.
+- **Sign in to your company's GitLab or GitHub Enterprise.** On the connect
+  page, type the host: if someone there already set up sign-in, use it;
+  otherwise register an OAuth application once, following the exact redirect
+  URI and scopes the page shows, and everyone at that host can sign in from
+  then on.
+- `server.json` lists the remote endpoint, so registries show both the npm
+  package and the hosted server.
+- Both servers declare the project icon in `serverInfo.icons`.
+
+### Fixed
+
+- GitLab requests send the token as `Authorization: Bearer` instead of
+  `PRIVATE-TOKEN`. Personal access tokens work either way, but OAuth tokens —
+  from `glab`'s browser login or from the remote server's sign-in — were
+  rejected with 401.
+
 ## [0.7.0] - 2026-10-10
 
 ### Added

package/README.md

@@ -66,12 +66,55 @@ So if you already use `gh` or `glab`, there is nothing to configure.
 npx standup-mr fetch --markdown | npx standup-mr post --slack "$SLACK_WEBHOOK_URL"
 ```
 
-## The three surfaces
+## claude.ai (web and mobile)
+
+No token, no config file — sign in instead. In claude.ai open **Settings →
+Connectors → Add custom connector** and paste:
+
+```
+https://standup.ilkerbalcilar.com/mcp
+```
+
+Press **Connect**. A page opens where you link the accounts the note should
+read:
+
+- **GitHub** — sign in through the standup-mr GitHub App. It only sees the
+  repositories it is installed on, so install it on your org too; if the org
+  won't approve it, add github.com with a fine-grained token instead.
+- **gitlab.com** — sign in with GitLab.
+- **Your company's GitLab or GitHub Enterprise** — type the host. If someone
+  at your company already set up sign-in, you get a "Sign in with …" button.
+  Otherwise set it up once: the page shows the exact redirect URI and scopes
+  for an OAuth application on your host, you paste its ID and secret, and
+  everyone at that host can sign in from then on. A read-only token works too.
+- **Chat webhook** _(optional)_ — Slack, Discord or Google Chat, so Claude can
+  post the finished note when you ask it to.
+
+Link as many as you like — say, GitHub for side projects and your company's
+GitLab for work — then ask for "my standup" or "my work standup". With
+several accounts linked, Claude asks which one you mean.
+
+The connector then works from the claude.ai mobile app as well.
+
+**What is stored.** Your provider tokens and webhook URL, encrypted with
+AES-256-GCM, and only to read your merge requests and post your note. The
+access tokens Claude holds are stored as hashes. Disconnecting the connector
+deletes everything; connections unused for 30 days are deleted. The server is
+the code in [`remote/`](remote/).
+
+**When to use the local server instead.** A GitLab behind a VPN or on a
+private network is out of reach of a hosted server. Run the stdio server
+below on your own machine — the token never leaves it.
+
+## The four surfaces
 
 **CLI** — the core. Emits JSON; zero runtime dependencies.
 
-**MCP server** (`mcp/`) — one tool, `get_standup_data`, for Claude Desktop,
-Cursor, or any MCP client. See [`mcp/README.md`](mcp/README.md).
+**MCP server** (`mcp/`) — three tools for Claude Desktop, Claude Code, Cursor,
+or any MCP client that runs a local process. See [`mcp/README.md`](mcp/README.md).
+
+**Remote MCP server** (`remote/`) — the same tools over HTTPS with sign-in, for
+claude.ai on the web and on mobile. See [above](#claudeai-web-and-mobile).
 
 **Claude Code plugin** — the note-writing playbook, shipped as the `standup`
 skill. From inside Claude Code:
@@ -205,6 +248,16 @@ that pipeline is red; this one opens the failed job's log and shows you the
 404 — and a 404 rather than a 403 usually means the token's scope is wrong, not
 that the package is missing.
 
+## Stability
+
+Since 1.0.0 the CLI commands and flags, the JSON that `fetch` and
+`get_standup_data` return, the MCP tool names and arguments, and the
+environment variables follow [semantic versioning](https://semver.org/): a
+change that would break an existing setup waits for a major release. New
+fields in the JSON may appear in minor releases, so read it by name rather
+than by position. The hosted server at `standup.ilkerbalcilar.com` is
+updated continuously and is not tied to the npm version.
+
 ## Known limits
 
 - **GitHub's events feed is shallow.** It is capped at roughly 300 events over

package/dist/{chunk-J5LAGA3U.js → chunk-S7DAKN36.js}

@@ -810,7 +810,10 @@ var GitLabProvider = class {
     const response = await sendWithRetry(
       this.fetchImpl,
       url,
-      { headers: { "PRIVATE-TOKEN": this.token } },
+      // Bearer, not PRIVATE-TOKEN: GitLab accepts personal access tokens
+      // either way, but OAuth tokens — glab's browser login, and the
+      // remote server's sign-in — only as a bearer.
+      { headers: { Authorization: `Bearer ${this.token}` } },
       this.host
     );
     assertUsable(response, this.host);

package/dist/cli.js

@@ -8,7 +8,7 @@ import {
   postWebhook,
   readStandupSkillBody,
   toMarkdown
-} from "./chunk-J5LAGA3U.js";
+} from "./chunk-S7DAKN36.js";
 
 // src/cli/cli.ts
 import { realpathSync } from "fs";

package/dist/index.js

@@ -45,7 +45,7 @@ import {
   toMarkdown,
   undiagnosed,
   unreachable
-} from "./chunk-J5LAGA3U.js";
+} from "./chunk-S7DAKN36.js";
 export {
   ApiError,
   ConfigError,

package/dist/mcp/server.js

@@ -842,7 +842,10 @@ var GitLabProvider = class {
     const response = await sendWithRetry(
       this.fetchImpl,
       url,
-      { headers: { "PRIVATE-TOKEN": this.token } },
+      // Bearer, not PRIVATE-TOKEN: GitLab accepts personal access tokens
+      // either way, but OAuth tokens — glab's browser login, and the
+      // remote server's sign-in — only as a bearer.
+      { headers: { Authorization: `Bearer ${this.token}` } },
       this.host
     );
     assertUsable(response, this.host);
@@ -1277,22 +1280,48 @@ async function runPostTool(args, deps = {}) {
 async function runInstructionsTool() {
   return text(readStandupSkillBody());
 }
+var STANDUP_TOOL_ANNOTATIONS = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true
+};
+var POST_TOOL_ANNOTATIONS = {
+  readOnlyHint: false,
+  destructiveHint: false,
+  idempotentHint: false,
+  openWorldHint: true
+};
+var INSTRUCTIONS_TOOL_ANNOTATIONS = {
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false
+};
+var SERVER_ICONS = [
+  {
+    src: "https://raw.githubusercontent.com/Jubstaaa/standup-mr/main/assets/icon-512.png",
+    mimeType: "image/png",
+    sizes: ["512x512"]
+  },
+  {
+    src: "https://raw.githubusercontent.com/Jubstaaa/standup-mr/main/assets/icon.svg",
+    mimeType: "image/svg+xml",
+    sizes: ["any"]
+  }
+];
 function createServer() {
   const server = new McpServer({
     name: "standup-mr",
-    version: packageVersion(import.meta.url)
+    version: packageVersion(import.meta.url),
+    icons: SERVER_ICONS
   });
   server.registerTool(
     "get_standup_data",
     {
       description: STANDUP_TOOL_DESCRIPTION,
       inputSchema: STANDUP_TOOL_SCHEMA,
-      annotations: {
-        readOnlyHint: true,
-        destructiveHint: false,
-        idempotentHint: true,
-        openWorldHint: true
-      }
+      annotations: STANDUP_TOOL_ANNOTATIONS
     },
     async (args) => await runStandupTool(args)
   );
@@ -1301,12 +1330,7 @@ function createServer() {
     {
       description: POST_TOOL_DESCRIPTION,
       inputSchema: POST_TOOL_SCHEMA,
-      annotations: {
-        readOnlyHint: false,
-        destructiveHint: false,
-        idempotentHint: false,
-        openWorldHint: true
-      }
+      annotations: POST_TOOL_ANNOTATIONS
     },
     async (args) => await runPostTool(args)
   );
@@ -1314,12 +1338,7 @@ function createServer() {
     "get_note_instructions",
     {
       description: INSTRUCTIONS_TOOL_DESCRIPTION,
-      annotations: {
-        readOnlyHint: true,
-        destructiveHint: false,
-        idempotentHint: true,
-        openWorldHint: false
-      }
+      annotations: INSTRUCTIONS_TOOL_ANNOTATIONS
     },
     async () => await runInstructionsTool()
   );
@@ -1345,16 +1364,22 @@ if (entryUrl && import.meta.url === entryUrl) {
   });
 }
 export {
+  INSTRUCTIONS_TOOL_ANNOTATIONS,
   INSTRUCTIONS_TOOL_DESCRIPTION,
+  POST_TOOL_ANNOTATIONS,
   POST_TOOL_DESCRIPTION,
   POST_TOOL_SCHEMA,
+  SERVER_ICONS,
+  STANDUP_TOOL_ANNOTATIONS,
   STANDUP_TOOL_DESCRIPTION,
   STANDUP_TOOL_SCHEMA,
   WEBHOOK_URL_ENV,
   collect,
   createServer,
+  failure,
   main,
   runInstructionsTool,
   runPostTool,
-  runStandupTool
+  runStandupTool,
+  text
 };

package/llms-install.md

@@ -3,6 +3,11 @@
 Instructions for an AI assistant setting this MCP server up on a user's
 machine. Everything here is verified against the published package.
 
+If the user is on claude.ai (web or mobile) rather than a client that runs
+local processes, none of this applies: tell them to add
+`https://standup.ilkerbalcilar.com/mcp` under Settings → Connectors → Add custom
+connector and sign in on the page that opens.
+
 ## What it needs
 
 - Node.js 20 or newer. Nothing to clone, nothing to build — the server runs

package/mcp/README.md

@@ -1,8 +1,13 @@
 # MCP server
 
-Exposes one tool, `get_standup_data`, for either GitLab or GitHub, returning
+Exposes three tools — `get_standup_data`, `get_note_instructions` and
+`post_standup_note` — for either GitLab or GitHub. `get_standup_data` returns
 the same JSON as `standup fetch`.
 
+This is the local, stdio server: it runs on your machine and reads tokens from
+its environment. On claude.ai (web or mobile), use the hosted connector instead
+— see [claude.ai (web and mobile)](../README.md#claudeai-web-and-mobile).
+
 ## Configure
 
 GitLab:

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "standup-mr",
-    "version": "0.7.0",
+    "version": "1.0.0",
     "mcpName": "io.github.Jubstaaa/standup-mr",
     "description": "Standup notes from merge request state, not commit logs.",
     "keywords": [
@@ -53,6 +53,9 @@
         "CHANGELOG.md",
         "LICENSE"
     ],
+    "workspaces": [
+        "remote"
+    ],
     "scripts": {
         "build": "tsup",
         "lint": "eslint .",
@@ -64,8 +67,8 @@
         "prepublishOnly": "tsup"
     },
     "dependencies": {
-        "@modelcontextprotocol/sdk": "^1.30.0",
-        "zod": "^4.4.3"
+        "@modelcontextprotocol/sdk": "^1.32.1",
+        "zod": "^4.6.6"
     },
     "devDependencies": {
         "@eslint/js": "^9.39.1",