tascan-mcp 3.13.0 → 3.13.1

package/README.md

@@ -268,6 +268,9 @@ API keys are scoped to your organization and support rate limiting (60 requests/
 
 ## Changelog
 
+### v3.13.1 — 2026-09-14
+- Docs only. `tascan_get_task` and `tascan_get_receipt` now say it plainly: a completion with status `completed` means the executor returned and a result was recorded — it does **not** mean the result was accepted. Acceptance is the receipt's `verification.result` under a named policy, and in v0.1 no policy runs for agent tasks (`no_policy_run`), so read the recorded response before treating an agent completion as success (protocol §8.3 C11). The receipt description also lists the eleven-step verifier (65,536-byte size gate, real-calendar datetimes, GPS bounds, token-free locators, `verifier.identity` vocabulary). No tool additions — still 70 tools.
+
 ### v3.13.0 — 2026-09-14
 - **Authorization scopes.** Every key and OAuth grant now carries a tier — `read`, `write`, or `full` — plus two additive permissions: `agent:dispatch` (hand PLAN/RESEARCH/WRITE/REVIEW/DEFAULT tasks to an AI agent inbox) and `agent:dispatch:code` (CODE/SHELL tasks, which run on the org's own machine). Tools are classified in `scopes.cjs`; a call outside the grant returns an `isError` result naming the scope to reconnect with. Existing OAuth connections must reconnect and tick the dispatch boxes on the consent page to dispatch again.
 - **`tascan_get_receipt` (new, 70 tools).** Fetches the signed Action Receipt (Ed25519 JWS, TaScan Protocol v0.1) for one completion: what was done, by whom, evidence hashes, verification, ledger chain head — with per-field provenance. Verify offline against `https://app.tascan.io/.well-known/tascan-receipt-keys.json` or online via `POST /api/v1/receipts/verify`. Spec: https://app.tascan.io/docs/protocol/TASCAN-PROTOCOL-v0.1.md

package/index.js

@@ -46,7 +46,7 @@ async function api(method, path, body) {
 api.key = API_KEY;   // raw-fetch tools read the key from here (S99: those functions now require auth)
 
 const server = new Server(
-  { name: 'tascan', version: '3.13.0' },
+  { name: 'tascan', version: '3.13.1' },
   { capabilities: { tools: {} } }
 );
 

package/package.json

@@ -1,55 +1,55 @@
-{
-  "name": "tascan-mcp",
-  "version": "3.13.0",
-  "mcpName": "io.github.snowbikemike/tascan-mcp",
-  "description": "TaScan MCP Server — Closed-loop autonomous operations protocol. 70 tools for projects, tasks, workers, QR codes, NFC tags, worker marketplace with consented SMS invites, geofenced zones with rules (work site / hazard + AI-verified PPE checkpoints / containment / restricted, breach alerts, zone compliance audit), AI condition assessment, worker passports, verification-gated gig payments, client invoicing from verified work (overtime / day rate / per diem / expenses), shareable report links (completion, client service report, project, evidence pack), signed Action Receipts (Ed25519 JWS), cross-entity search, duplicate-worker detection, worker identity merge, AI issue analysis, and autonomous remediation dispatch. 15 patents filed (470+ claims). Task. Scan. Done.",
-  "type": "module",
-  "main": "index.js",
-  "bin": {
-    "tascan-mcp": "index.js"
-  },
-  "scripts": {
-    "start": "node index.js"
-  },
-  "files": [
-    "index.js",
-    "tools.cjs",
-    "scopes.cjs",
-    "README.md",
-    "LICENSE"
-  ],
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.27.0",
-    "zod": "^4.3.6"
-  },
-  "keywords": [
-    "tascan",
-    "mcp",
-    "model-context-protocol",
-    "ai",
-    "task-management",
-    "qr-code",
-    "field-operations",
-    "workforce",
-    "pwa",
-    "claude"
-  ],
-  "author": {
-    "name": "Michael Edward Love II",
-    "email": "Michael@TaScan.io",
-    "url": "https://tascan.io"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/snowbikemike/tascan-mcp.git"
-  },
-  "homepage": "https://tascan.io",
-  "bugs": {
-    "url": "https://github.com/snowbikemike/tascan-mcp/issues",
-    "email": "Michael@TaScan.io"
-  },
-  "license": "MIT",
-  "engines": {
-    "node": ">=18.0.0"
-  }
-}
+{
+  "name": "tascan-mcp",
+  "version": "3.13.1",
+  "mcpName": "io.github.snowbikemike/tascan-mcp",
+  "description": "TaScan MCP Server — Closed-loop autonomous operations protocol. 70 tools for projects, tasks, workers, QR codes, NFC tags, worker marketplace with consented SMS invites, geofenced zones with rules (work site / hazard + AI-verified PPE checkpoints / containment / restricted, breach alerts, zone compliance audit), AI condition assessment, worker passports, verification-gated gig payments, client invoicing from verified work (overtime / day rate / per diem / expenses), shareable report links (completion, client service report, project, evidence pack), signed Action Receipts (Ed25519 JWS), cross-entity search, duplicate-worker detection, worker identity merge, AI issue analysis, and autonomous remediation dispatch. 15 patents filed (470+ claims). Task. Scan. Done.",
+  "type": "module",
+  "main": "index.js",
+  "bin": {
+    "tascan-mcp": "index.js"
+  },
+  "scripts": {
+    "start": "node index.js"
+  },
+  "files": [
+    "index.js",
+    "tools.cjs",
+    "scopes.cjs",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.27.0",
+    "zod": "^4.3.6"
+  },
+  "keywords": [
+    "tascan",
+    "mcp",
+    "model-context-protocol",
+    "ai",
+    "task-management",
+    "qr-code",
+    "field-operations",
+    "workforce",
+    "pwa",
+    "claude"
+  ],
+  "author": {
+    "name": "Michael Edward Love II",
+    "email": "Michael@TaScan.io",
+    "url": "https://tascan.io"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/snowbikemike/tascan-mcp.git"
+  },
+  "homepage": "https://tascan.io",
+  "bugs": {
+    "url": "https://github.com/snowbikemike/tascan-mcp/issues",
+    "email": "Michael@TaScan.io"
+  },
+  "license": "MIT",
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}

package/tools.cjs

@@ -420,7 +420,7 @@ const TOOLS = [
   },
   {
     name: 'tascan_get_task',
-    description: 'Get details of a specific task including completions and subtasks. Each completion carries photo_url (raw storage path, stable) and photo_signed_url (short-lived fetchable URL, ~1h; null when no photo) so you can actually view the photo evidence. Tasks dispatched to an AI agent also carry an "agent" block (state claimed|running|completed|failed|expired|released, attempts, current run with runner/trace_id/error) — the only place agent failures are reported.',
+    description: 'Get details of a specific task including completions and subtasks. Each completion carries photo_url (raw storage path, stable) and photo_signed_url (short-lived fetchable URL, ~1h; null when no photo) so you can actually view the photo evidence. Tasks dispatched to an AI agent also carry an "agent" block (state claimed|running|completed|failed|expired|released, attempts, current run with runner/trace_id/error) — the only place agent failures are reported. A completion with status "completed" means the executor returned and its result was recorded (a model refusal, a wrong answer or an administrative note all "complete"); it does NOT mean the requested result was accepted. Acceptance is the completion evidence_check / the receipt verification.result under a named policy, and in v0.1 no policy exists for agent tasks (exact-output and rubric policies are v0.2) — check the recorded response text yourself before treating an agent completion as success (protocol §2.6, §3.2, §8.3 C11).',
     inputSchema: {
       type: 'object',
       properties: { task_id: { type: 'string', description: 'Task ID' } },
@@ -442,7 +442,7 @@ const TOOLS = [
   },
   {
     name: 'tascan_get_receipt',
-    description: 'Fetch the signed Action Receipt (Ed25519 JWS) for one completed task. Takes the completion_id (tascan_get_task -> completions[].id). Returns a human-readable summary (what was done, by whom, verification level, evidence hashes, AI verification result, outcome, ledger chain) plus receipt_id/serial/kid, the compact JWS, and the public verify URL. Anyone can verify the JWS offline against the JWKS or online by POSTing {jws} to the verify URL. Read tier.',
+    description: 'Fetch the signed Action Receipt (Ed25519 JWS) for one completed task by completion_id (tascan_get_task -> completions[].id). Returns a readable summary (what, who, verification, evidence hashes, outcome, ledger chain) plus receipt_id/serial/kid, the compact JWS and the public verify URL. Verify offline against the JWKS or online by POSTing a JSON body whose jws field holds the compact receipt. Read outcome and verification separately: outcome completed = the executor returned and a result was recorded; verification.result = the verdict of a named policy (policy_id/version/hash + verifier non-null together); all-null verification with reason no_policy_run = no policy ran, true of every agent task in v0.1. Never treat outcome=completed as success without a policy verdict you trust (protocol 8.3 C11). Verifier = eleven steps (6.8): JWS over 65,536 bytes = too_large; real datetimes; GPS inside the globe; locators never carry a list token; verifier.identity is ai:, admin:, customer: or system: prefixed. Read tier.',
     inputSchema: {
       type: 'object',
       properties: { completion_id: { type: 'string', description: 'task_completions.id (UUID) - from tascan_get_task -> completions[].id' } },