tascan-mcp 3.16.0 → 3.16.2

package/README.md

@@ -288,6 +288,9 @@ API keys are scoped to your organization and support rate limiting (60 requests/
 
 ## Changelog
 
+### v3.16.2 — 2026-09-28
+- 98 tools.  Rolls up 3.16.0 to 3.16.2: `tascan_get_usage` (GET /usage, per-key daily actions and rate-limit headers, migration 220); the device control plane read/revoke tools (`tascan_list_devices`, `tascan_get_device`, `tascan_revoke_device`; register and rotate stay admin-app only by design); `tascan_delegate_to_agent` (child keys with a TTL of 60 s to 24 h clamped to the parent, non-delegable flags refused, the plaintext returned once) and the per-key action budgets that fail closed (migration 221).  Hosted MCP at https://app.tascan.io/mcp already serves this version; this release brings the stdio package up to it.
+
 ### v3.15.0 — 2026-09-19
 
 - `tascan_create_cycle` gains an optional `reviews[]` array — a multi-lens review panel (design item 14a): 1–8 lenses, each `{lens, brief, provider: openai|anthropic|gemini, model?, blocking? (default true), max_tool_calls? (openai only)}`, forwarded to `POST /coord/cycles`; at least one lens must be blocking.  Omit it for the single OpenAI review.

package/index.js

@@ -15,6 +15,7 @@ import { createRequire } from 'module';
 
 const require = createRequire(import.meta.url);
 const { TOOLS } = require('./tools.cjs');
+const crypto = require('crypto');   // B1 (migration 220): crypto.randomUUID() is a Node built-in, no new dependency
 
 const API_BASE = process.env.TASCAN_API_URL || 'https://app.tascan.io/api/v1';
 const API_KEY = process.env.TASCAN_API_KEY || '';
@@ -24,8 +25,11 @@ if (!API_KEY) {
   process.exit(1);
 }
 
-// Transport-bound REST call handed to every tool handler
-async function api(method, path, body) {
+// Transport-bound REST call handed to every tool handler.  B1 (migration 220): every POST/PUT sends an
+// Idempotency-Key — a fresh crypto.randomUUID() per call by default, or idemKey verbatim when a tool (e.g.
+// tascan_send_sms, tascan_request_payment, tascan_add_tasks) passes one through so a RETRIED call reuses the
+// same key instead of minting a new reservation (and re-running the handler) every time.
+async function api(method, path, body, idemKey) {
   const opts = {
     method,
     headers: {
@@ -36,6 +40,9 @@ async function api(method, path, body) {
   if (body && (method === 'POST' || method === 'PUT')) {
     opts.body = JSON.stringify(body);
   }
+  if (method === 'POST' || method === 'PUT') {
+    opts.headers['Idempotency-Key'] = idemKey || crypto.randomUUID();
+  }
   const resp = await fetch(API_BASE + path, opts);
   const data = await resp.json();
   if (!resp.ok) {
@@ -46,7 +53,7 @@ async function api(method, path, body) {
 api.key = API_KEY;   // raw-fetch tools read the key from here (S99: those functions now require auth)
 
 const server = new Server(
-  { name: 'tascan', version: '3.16.0' },
+  { name: 'tascan', version: '3.16.2' },
   { capabilities: { tools: {} } }
 );
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tascan-mcp",
-  "version": "3.16.0",
+  "version": "3.16.2",
   "mcpName": "io.github.snowbikemike/tascan-mcp",
   "description": "TaScan MCP Server — Closed-loop autonomous operations protocol. 70 tools for projects, tasks, workers, QR codes, NFC tags, worker marketplace with consented SMS invites, geofenced zones with rules (work site / hazard + AI-verified PPE checkpoints / containment / restricted, breach alerts, zone compliance audit), AI condition assessment, worker passports, verification-gated gig payments, client invoicing from verified work (overtime / day rate / per diem / expenses), shareable report links (completion, client service report, project, evidence pack), signed Action Receipts (Ed25519 JWS), cross-entity search, duplicate-worker detection, worker identity merge, AI issue analysis, and autonomous remediation dispatch. 15 patents filed (470+ claims). Task. Scan. Done.",
   "type": "module",
@@ -14,6 +14,7 @@
   "files": [
     "index.js",
     "tools.cjs",
+    "tools-devices.cjs",
     "scopes.cjs",
     "README.md",
     "LICENSE"