untappd-mcp 2.0.0 → 2.1.1

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Untappd — beers, breweries, venues, check-ins, wishlists, and your friend feed",
-    "version": "2.0.0"
+    "version": "2.1.1"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Untappd",
       "source": "./",
       "description": "MCP server for Untappd — search beers/breweries/venues, read profiles/check-ins/wishlists, and post check-ins, toasts, and comments",
-      "version": "2.0.0",
+      "version": "2.1.1",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "untappd-mcp",
   "displayName": "Untappd",
-  "version": "2.0.0",
+  "version": "2.1.1",
   "description": "MCP server for Untappd — search beers/breweries/venues, read check-ins and wishlists, and post check-ins, toasts, and comments",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -23302,6 +23302,20 @@ var require_v4 = __commonJS({
   }
 });
 
+// node_modules/@chrischall/mcp-utils/dist/cancel/index.js
+import { AsyncLocalStorage } from "node:async_hooks";
+var storage = new AsyncLocalStorage();
+function withCallSignal(signal, fn, request) {
+  return signal ? storage.run({ signal, ...request ? { request } : {} }, fn) : fn();
+}
+
+// node_modules/@chrischall/mcp-utils/dist/caller/index.js
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var storage2 = new AsyncLocalStorage2();
+function withCallerCapabilities(capabilities, fn) {
+  return capabilities ? storage2.run(capabilities, fn) : fn();
+}
+
 // node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create2 = Object.create;
 var __defProp2 = Object.defineProperty;
@@ -24476,6 +24490,7 @@ function missingClientCapabilities(required2, declared) {
   return Object.keys(missing).length > 0 ? missing : void 0;
 }
 var FIRST_MODERN_PROTOCOL_VERSION = "2026-07-28";
+var SUPPORTED_MODERN_PROTOCOL_VERSIONS = [FIRST_MODERN_PROTOCOL_VERSION];
 function isModernProtocolVersion(version2) {
   return version2 >= FIRST_MODERN_PROTOCOL_VERSION;
 }
@@ -27034,6 +27049,25 @@ function isSpecNotificationMethod(method) {
   return ALL_CODECS.some((codec2) => codec2.hasNotificationMethod(method));
 }
 var ALL_CODECS = [rev2025Codec, rev2026Codec];
+function isPlainObject$3(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function requestMetaOf(params) {
+  if (!isPlainObject$3(params)) return void 0;
+  const meta3 = params["_meta"];
+  return isPlainObject$3(meta3) ? meta3 : void 0;
+}
+function hasEnvelopeClaim(params) {
+  const meta3 = requestMetaOf(params);
+  return meta3 !== void 0 && PROTOCOL_VERSION_META_KEY in meta3;
+}
+function envelopeClaimVersion(params) {
+  const value = requestMetaOf(params)?.[PROTOCOL_VERSION_META_KEY];
+  return typeof value === "string" ? value : void 0;
+}
+function validateEnvelopeMeta(meta3) {
+  return codecForVersion(MODERN_WIRE_REVISION).validateEnvelopeMeta(meta3);
+}
 var schemas_exports = /* @__PURE__ */ __exportAll({
   AnnotationsSchema: () => AnnotationsSchema,
   AudioContentSchema: () => AudioContentSchema,
@@ -27384,6 +27418,45 @@ var LADDER_ERROR_HTTP_STATUS = {
   [ProtocolErrorCode.MissingRequiredClientCapability]: 400,
   [HEADER_MISMATCH_ERROR_CODE]: 400
 };
+function rejection(rung, cell, httpStatus, error62, settled) {
+  return {
+    kind: "reject",
+    rung,
+    cell,
+    httpStatus,
+    code: error62.code,
+    message: error62.message,
+    ...error62.data !== void 0 && { data: error62.data },
+    settled
+  };
+}
+function carriesValidModernEnvelopeClaim(params) {
+  if (!hasEnvelopeClaim(params)) return false;
+  const claimedVersion = envelopeClaimVersion(params);
+  if (claimedVersion === void 0 || !isModernProtocolVersion(claimedVersion)) return false;
+  const meta3 = requestMetaOf(params);
+  return meta3 !== void 0 && validateEnvelopeMeta(meta3).length === 0;
+}
+function modernOnlyStrictRejection(route, supportedVersions) {
+  switch (route.reason) {
+    case "http-method":
+      return rejection("http-method", "modern-only-method-not-allowed", 405, new ProtocolError(-32e3, "Method not allowed."), true);
+    case "batch":
+      return rejection("jsonrpc-shape", "modern-only-batch-not-supported", 400, new ProtocolError(ProtocolErrorCode.InvalidRequest, "Bad Request: JSON-RPC batches are not supported by this endpoint"), true);
+    case "response":
+      return rejection("jsonrpc-shape", "modern-only-response-post", 400, new ProtocolError(ProtocolErrorCode.InvalidRequest, "Bad Request: JSON-RPC responses cannot be posted to this endpoint"), true);
+    case "notification":
+      return;
+    case "initialize":
+    case "no-claim": {
+      const requested = route.requestedVersion;
+      return rejection("era-classification", "modern-only-missing-envelope", 400, requested === void 0 ? new ProtocolError(ProtocolErrorCode.UnsupportedProtocolVersion, "Unsupported protocol version: the request did not name a protocol version", { supported: [...supportedVersions] }) : new UnsupportedProtocolVersionError({
+        supported: [...supportedVersions],
+        requested
+      }), true);
+    }
+  }
+}
 function parseSchema(schema, data) {
   return z2.safeParse(schema, data);
 }
@@ -27945,6 +28018,9 @@ function withRequestStateValue(ctx, value) {
   };
 }
 var writeNegotiatedProtocolVersion;
+function setNegotiatedProtocolVersion(instance, version2) {
+  writeNegotiatedProtocolVersion(instance, version2);
+}
 var Protocol = class {
   _transport;
   _requestMessageId = 0;
@@ -35888,6 +35964,190 @@ function getCompleter(schema) {
   return schema[COMPLETABLE_SYMBOL]?.complete;
 }
 var MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+function listenFilterAccepts(filter, event) {
+  switch (event.kind) {
+    case "tools_list_changed":
+      return filter.toolsListChanged === true;
+    case "prompts_list_changed":
+      return filter.promptsListChanged === true;
+    case "resources_list_changed":
+      return filter.resourcesListChanged === true;
+    case "resource_updated":
+      return filter.resourceSubscriptions !== void 0 && filter.resourceSubscriptions.includes(event.uri);
+  }
+}
+function honoredSubset(requested, capabilities) {
+  const honored = {};
+  const allow = (bit) => capabilities === void 0 || bit === true;
+  if (requested.toolsListChanged === true && allow(capabilities?.tools?.listChanged)) honored.toolsListChanged = true;
+  if (requested.promptsListChanged === true && allow(capabilities?.prompts?.listChanged)) honored.promptsListChanged = true;
+  if (requested.resourcesListChanged === true && allow(capabilities?.resources?.listChanged)) honored.resourcesListChanged = true;
+  if (requested.resourceSubscriptions !== void 0 && requested.resourceSubscriptions.length > 0 && allow(capabilities?.resources?.subscribe)) honored.resourceSubscriptions = [...requested.resourceSubscriptions];
+  return honored;
+}
+var DEFAULT_MAX_SUBSCRIPTIONS = 1024;
+function stampSubscriptionId(notification, subscriptionId) {
+  return {
+    method: notification.method,
+    params: {
+      ...notification.params,
+      _meta: {
+        ...notification.params?._meta,
+        [SUBSCRIPTION_ID_META_KEY]: subscriptionId
+      }
+    }
+  };
+}
+function parseListenFilter(message) {
+  const outcome = codecForVersion(MODERN_WIRE_REVISION).validateRequest("subscriptions/listen", message);
+  return outcome.ok ? outcome.value.params?.notifications : void 0;
+}
+var CHANGE_NOTIFICATION_METHODS = /* @__PURE__ */ new Set([
+  "notifications/tools/list_changed",
+  "notifications/prompts/list_changed",
+  "notifications/resources/list_changed",
+  "notifications/resources/updated"
+]);
+var StdioListenRouter = class {
+  /** Active subscriptions, keyed by the listen request's JSON-RPC id verbatim. */
+  _subs = /* @__PURE__ */ new Map();
+  /**
+  * The serving instance's declared capabilities. Filled in by the entry
+  * once the modern instance is constructed (the router is created before
+  * the instance exists), so the acknowledged filter is narrowed against
+  * what the server can actually deliver.
+  */
+  _serverCapabilities;
+  /**
+  * The serving instance's identity, stamped onto the graceful-close
+  * results' `_meta` (the spec's `SubscriptionsListenResultMeta` extends
+  * `ResultMetaObject`). Handed over together with the capabilities.
+  */
+  _serverInfo;
+  constructor(_maxSubscriptions = DEFAULT_MAX_SUBSCRIPTIONS, serverCapabilities, serverInfo) {
+    this._maxSubscriptions = _maxSubscriptions;
+    this._serverCapabilities = serverCapabilities;
+    this._serverInfo = serverInfo;
+  }
+  /**
+  * Record the serving instance's declared capabilities and identity once
+  * it has been constructed. Called by `serveStdio`'s connect path;
+  * subsequent `serve()` calls narrow the honored filter against the
+  * capabilities, and `teardownAll()` stamps the identity.
+  */
+  setServerCapabilities(capabilities, serverInfo) {
+    this._serverCapabilities = capabilities;
+    if (serverInfo !== void 0) this._serverInfo = serverInfo;
+  }
+  /** Whether `id` is an active listen subscription on this connection. */
+  has(id) {
+    return this._subs.has(id);
+  }
+  /**
+  * Serve one inbound `subscriptions/listen` request: registers the
+  * subscription and returns the stamped acknowledged notification (or, on
+  * capacity / params rejection, the in-band JSON-RPC error response).
+  *
+  * @throws when called before {@linkcode setServerCapabilities} (or the
+  * constructor) has supplied the serving instance's capabilities. Honoring a
+  * filter without knowing the server's advertised capabilities would fail
+  * open (deliver unadvertised types); the entry guarantees capabilities are
+  * set before any listen request is routed here.
+  */
+  serve(message) {
+    if (this._serverCapabilities === void 0) throw new Error("StdioListenRouter.serve() called before setServerCapabilities(); refusing to honor a filter without capabilities");
+    if (this._subs.size >= this._maxSubscriptions) return {
+      jsonrpc: "2.0",
+      id: message.id,
+      error: {
+        code: -32603,
+        message: "Subscription limit reached"
+      }
+    };
+    const filter = parseListenFilter(message);
+    if (filter === void 0) return {
+      jsonrpc: "2.0",
+      id: message.id,
+      error: {
+        code: -32602,
+        message: "Invalid params: 'notifications' is required and must be a valid SubscriptionFilter"
+      }
+    };
+    const honored = honoredSubset(filter, this._serverCapabilities);
+    this._subs.set(message.id, honored);
+    return stampSubscriptionId({
+      method: "notifications/subscriptions/acknowledged",
+      params: { notifications: honored }
+    }, message.id);
+  }
+  /**
+  * Tear down one subscription (inbound `notifications/cancelled`). Returns
+  * `true` when a subscription was removed. After this call NOTHING further
+  * is delivered for that subscription id (the post-cancel hardening).
+  */
+  cancel(id) {
+    return this._subs.delete(id);
+  }
+  /**
+  * Route an outbound notification through the active subscriptions.
+  *
+  * - For a subscription-gated change notification, returns one stamped copy
+  *   per subscription that opted in to it (an empty array means it is
+  *   dropped — the modern era never delivers an un-requested change type).
+  * - For any other outbound message, returns `'passthrough'` (the entry
+  *   forwards it as-is).
+  */
+  routeOutbound(message) {
+    if (!CHANGE_NOTIFICATION_METHODS.has(message.method)) return "passthrough";
+    const uriParam = message.params?.["uri"];
+    const uri = typeof uriParam === "string" ? uriParam : void 0;
+    const event = notificationToServerEvent(message.method, uri);
+    const out = [];
+    for (const [subscriptionId, filter] of this._subs) if (listenFilterAccepts(filter, event)) out.push(stampSubscriptionId({
+      method: message.method,
+      params: message.params ?? {}
+    }, subscriptionId));
+    return out;
+  }
+  /**
+  * Server-side graceful teardown of every active subscription: returns the
+  * empty `subscriptions/listen` JSON-RPC result for each subscription id —
+  * the spec's graceful-close signal, `_meta` carrying the subscription id
+  * and the serving instance's identity — for the entry to emit before
+  * closing the wire. Clears the set so nothing further is delivered.
+  */
+  teardownAll() {
+    const out = [];
+    for (const id of this._subs.keys()) out.push({
+      jsonrpc: "2.0",
+      id,
+      result: {
+        resultType: "complete",
+        _meta: {
+          [SUBSCRIPTION_ID_META_KEY]: id,
+          ...this._serverInfo !== void 0 && { [SERVER_INFO_META_KEY]: this._serverInfo }
+        }
+      }
+    });
+    this._subs.clear();
+    return out;
+  }
+};
+function notificationToServerEvent(method, uri) {
+  switch (method) {
+    case "notifications/tools/list_changed":
+      return { kind: "tools_list_changed" };
+    case "notifications/prompts/list_changed":
+      return { kind: "prompts_list_changed" };
+    case "notifications/resources/list_changed":
+      return { kind: "resources_list_changed" };
+    default:
+      return {
+        kind: "resource_updated",
+        uri: uri ?? ""
+      };
+  }
+}
 var DEFAULT_LEGACY_SHIM_MAX_ROUNDS = 8;
 var DEFAULT_LEGACY_SHIM_ROUND_TIMEOUT_MS = 6e5;
 function resolveLegacyShimOptions(options) {
@@ -36025,6 +36285,12 @@ var INPUT_REQUIRED_CAPABLE_METHODS = /* @__PURE__ */ new Set([
 var writeClientIdentity;
 var installDiscoverHandler;
 var readServerIdentity;
+function installModernOnlyHandlers(server, servedModernVersions) {
+  installDiscoverHandler(server, servedModernVersions);
+}
+function serverIdentityOf(server) {
+  return readServerIdentity(server);
+}
 var Server = class extends Protocol {
   _clientCapabilities;
   _clientVersion;
@@ -37299,6 +37565,400 @@ var StdioServerTransport = class {
     });
   }
 };
+var DISCARD_ANSWER_TIMEOUT_MS = 3e3;
+var StdioConnectionChannel = class {
+  onclose;
+  onerror;
+  onmessage;
+  _closed = false;
+  /** Request ids the entry delivered to the instance that the instance has not yet answered. */
+  _pendingRequests = /* @__PURE__ */ new Set();
+  _drainWaiters = [];
+  constructor(_wire, _onInstanceClose, _outboundIntercept) {
+    this._wire = _wire;
+    this._onInstanceClose = _onInstanceClose;
+    this._outboundIntercept = _outboundIntercept;
+  }
+  async start() {
+  }
+  async send(message, options) {
+    if (isJSONRPCResultResponse(message) || isJSONRPCErrorResponse(message)) {
+      const { id } = message;
+      if (id !== void 0) this._settle(id);
+    }
+    if (this._closed) return;
+    if (this._outboundIntercept?.(message) === "handled") return;
+    return this._wire.send(message, options);
+  }
+  setProtocolVersion = (version2) => {
+    this._wire.setProtocolVersion?.(version2);
+  };
+  /** Forwards one inbound message to the connected instance. */
+  deliver(message, extra) {
+    if (this._closed) return;
+    if (isJSONRPCRequest(message)) this._pendingRequests.add(message.id);
+    else if (isJSONRPCNotification(message) && message.method === "notifications/cancelled") {
+      const cancelledId = message.params?.requestId;
+      if (cancelledId !== void 0) this._settle(cancelledId);
+    }
+    this.onmessage?.(message, extra);
+  }
+  /**
+  * Resolves once every request delivered to the instance has been answered
+  * through {@linkcode send}, settled by a delivered cancellation, or the
+  * channel has been closed and nothing further can be answered. The wait is
+  * bounded by `timeoutMs` as a backstop so no edge can hold the caller
+  * indefinitely; resolves `false` only when the bound elapsed with requests
+  * still unanswered. Used by the probe-discard path so a probe request the
+  * entry accepted is never silently dropped.
+  */
+  async whenRequestsAnswered(timeoutMs) {
+    if (this._closed || this._pendingRequests.size === 0) return true;
+    return await new Promise((resolve) => {
+      const waiter = () => {
+        clearTimeout(timer);
+        resolve(true);
+      };
+      const timer = setTimeout(() => {
+        this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
+        resolve(false);
+      }, timeoutMs);
+      this._drainWaiters.push(waiter);
+    });
+  }
+  async close() {
+    if (this._closed) return;
+    this._closed = true;
+    this._pendingRequests.clear();
+    this._releaseDrainWaiters();
+    try {
+      this._onInstanceClose();
+    } finally {
+      this.onclose?.();
+    }
+  }
+  _settle(id) {
+    this._pendingRequests.delete(id);
+    if (this._pendingRequests.size === 0) this._releaseDrainWaiters();
+  }
+  _releaseDrainWaiters() {
+    const waiters = this._drainWaiters;
+    this._drainWaiters = [];
+    for (const waiter of waiters) waiter();
+  }
+};
+function classifyOpeningMessage(message) {
+  const params = message.params;
+  if (message.method === "initialize" && !carriesValidModernEnvelopeClaim(params)) {
+    const requestedVersion = params !== null && typeof params === "object" && typeof params.protocolVersion === "string" ? params.protocolVersion : void 0;
+    return {
+      kind: "legacy",
+      reason: "initialize",
+      ...requestedVersion !== void 0 && { requestedVersion }
+    };
+  }
+  if (!hasEnvelopeClaim(params)) return {
+    kind: "legacy",
+    reason: "no-claim"
+  };
+  const meta3 = requestMetaOf(params);
+  const firstIssue = (meta3 === void 0 ? [] : validateEnvelopeMeta(meta3))[0];
+  if (firstIssue !== void 0) return {
+    kind: "invalid-envelope",
+    issue: firstIssue
+  };
+  const claimedVersion = envelopeClaimVersion(params);
+  if (claimedVersion === void 0 || !SUPPORTED_MODERN_PROTOCOL_VERSIONS.includes(claimedVersion)) return {
+    kind: "unsupported-revision",
+    requested: claimedVersion ?? "unknown"
+  };
+  return {
+    kind: "modern",
+    revision: claimedVersion,
+    classification: {
+      era: "modern",
+      revision: claimedVersion
+    }
+  };
+}
+function serveStdio(factory, options = {}) {
+  const legacyMode = options.legacy ?? "serve";
+  const wire = options.transport ?? new StdioServerTransport();
+  let state = { phase: "opening" };
+  let discarding;
+  let closing = false;
+  const isTornDown = () => closing || state.phase === "closed";
+  const reportError = (error62) => {
+    try {
+      options.onerror?.(error62);
+    } catch {
+    }
+  };
+  const writeErrorResponse = (id, code, message, data) => wire.send({
+    jsonrpc: "2.0",
+    id,
+    error: {
+      code,
+      message,
+      ...data !== void 0 && { data }
+    }
+  }).catch((error62) => reportError(toError(error62)));
+  const listenRouter = new StdioListenRouter(options.maxSubscriptions ?? DEFAULT_MAX_SUBSCRIPTIONS);
+  const modernOutboundIntercept = (message) => {
+    if (!isJSONRPCNotification(message)) return void 0;
+    const routed = listenRouter.routeOutbound(message);
+    if (routed === "passthrough") return void 0;
+    for (const stamped of routed) wire.send({
+      jsonrpc: "2.0",
+      ...stamped
+    }).catch((error62) => reportError(toError(error62)));
+    return "handled";
+  };
+  const tryServeListen = async (message) => {
+    if (isJSONRPCRequest(message) && message.method === "subscriptions/listen") {
+      const meta3 = requestMetaOf(message.params);
+      const issue2 = hasEnvelopeClaim(message.params) ? (meta3 === void 0 ? [] : validateEnvelopeMeta(meta3))[0] : {
+        key: "_meta",
+        problem: "the per-request envelope is required on protocol revision 2026-07-28"
+      };
+      const claimedVersion = envelopeClaimVersion(message.params);
+      let reply;
+      if (issue2 !== void 0) reply = {
+        jsonrpc: "2.0",
+        id: message.id,
+        error: {
+          code: -32602,
+          message: `Invalid _meta envelope: ${issue2.key}: ${issue2.problem}`
+        }
+      };
+      else if (claimedVersion === void 0 || !SUPPORTED_MODERN_PROTOCOL_VERSIONS.includes(claimedVersion)) {
+        const error62 = new UnsupportedProtocolVersionError({
+          supported: [...SUPPORTED_MODERN_PROTOCOL_VERSIONS],
+          requested: claimedVersion ?? "unknown"
+        });
+        reply = {
+          jsonrpc: "2.0",
+          id: message.id,
+          error: {
+            code: error62.code,
+            message: error62.message,
+            data: error62.data
+          }
+        };
+      } else reply = listenRouter.serve(message);
+      await wire.send("error" in reply ? reply : {
+        jsonrpc: "2.0",
+        method: reply.method,
+        params: reply.params
+      }).catch((error62) => reportError(toError(error62)));
+      return true;
+    }
+    if (isJSONRPCNotification(message) && message.method === "notifications/cancelled") {
+      const cancelledId = message.params?.requestId;
+      if (cancelledId !== void 0 && listenRouter.cancel(cancelledId)) return true;
+    }
+    return false;
+  };
+  const answerLegacyRejection = (request, reason, requestedVersion) => {
+    const rejection2 = modernOnlyStrictRejection({
+      kind: "legacy",
+      reason,
+      ...requestedVersion !== void 0 && { requestedVersion }
+    }, SUPPORTED_MODERN_PROTOCOL_VERSIONS);
+    if (rejection2 === void 0) return Promise.resolve();
+    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection2.cell}): ${rejection2.message}`));
+    return writeErrorResponse(request.id, rejection2.code, rejection2.message, rejection2.data);
+  };
+  const onInstanceClosed = (channel) => {
+    if (closing || channel === discarding) return;
+    closeAll();
+  };
+  const connectInstance = async (era, revision) => {
+    const product = await factory({ era });
+    const server = product instanceof McpServer ? product.server : product;
+    if (era === "modern") {
+      setNegotiatedProtocolVersion(server, revision);
+      installModernOnlyHandlers(server, SUPPORTED_MODERN_PROTOCOL_VERSIONS);
+      listenRouter.setServerCapabilities(server.getCapabilities(), serverIdentityOf(server));
+    }
+    const channel = new StdioConnectionChannel(wire, () => onInstanceClosed(channel), era === "modern" ? modernOutboundIntercept : void 0);
+    await product.connect(channel);
+    return {
+      product,
+      channel
+    };
+  };
+  const disposeLateInstance = (instance) => instance.product.close().catch((error62) => reportError(toError(error62)));
+  const discardProbeInstance = async (instance) => {
+    discarding = instance.channel;
+    try {
+      if (!await instance.channel.whenRequestsAnswered(DISCARD_ANSWER_TIMEOUT_MS)) reportError(/* @__PURE__ */ new Error(`Discarded the probe instance with requests still unanswered after ${DISCARD_ANSWER_TIMEOUT_MS}ms; continuing with the fallback`));
+      await instance.product.close();
+    } catch (error62) {
+      reportError(toError(error62));
+    } finally {
+      discarding = void 0;
+    }
+  };
+  const processMessage = async (message) => {
+    if (state.phase === "closed") return;
+    if (state.phase === "pinned") {
+      if (state.era === "modern" && isJSONRPCRequest(message) && message.method === "initialize" && !carriesValidModernEnvelopeClaim(message.params)) {
+        await answerLegacyRejection(message, "initialize", message.params !== null && typeof message.params === "object" && typeof message.params.protocolVersion === "string" ? message.params.protocolVersion : void 0);
+        return;
+      }
+      if (state.era === "modern" && await tryServeListen(message)) return;
+      state.instance.channel.deliver(message);
+      return;
+    }
+    if (!isJSONRPCRequest(message) && !isJSONRPCNotification(message)) {
+      reportError(/* @__PURE__ */ new Error("Discarded a JSON-RPC response received before the connection negotiated an era"));
+      return;
+    }
+    const opening = classifyOpeningMessage(message);
+    switch (opening.kind) {
+      case "invalid-envelope": {
+        const detail = `Invalid _meta envelope for protocol revision 2026-07-28: ${opening.issue.key}: ${opening.issue.problem}`;
+        if (isJSONRPCRequest(message)) await writeErrorResponse(message.id, ProtocolErrorCode.InvalidParams, detail, { envelope: opening.issue });
+        else reportError(/* @__PURE__ */ new Error(`Discarded a notification with a malformed envelope: ${detail}`));
+        return;
+      }
+      case "unsupported-revision":
+        if (isJSONRPCRequest(message)) {
+          const error62 = new UnsupportedProtocolVersionError({
+            supported: [...SUPPORTED_MODERN_PROTOCOL_VERSIONS],
+            requested: opening.requested
+          });
+          reportError(error62);
+          await writeErrorResponse(message.id, error62.code, error62.message, error62.data);
+        } else reportError(/* @__PURE__ */ new Error(`Discarded a notification claiming unsupported protocol revision ${opening.requested}`));
+        return;
+      case "modern":
+        if (isJSONRPCRequest(message) && message.method === "server/discover") {
+          if (state.phase === "probe") {
+            state.instance.channel.deliver(message, { classification: opening.classification });
+            return;
+          }
+          const instance = await connectInstance("modern", opening.revision);
+          if (isTornDown()) {
+            await disposeLateInstance(instance);
+            return;
+          }
+          state = {
+            phase: "probe",
+            instance
+          };
+          instance.channel.deliver(message, { classification: opening.classification });
+          return;
+        }
+        if (state.phase === "probe") {
+          if (isJSONRPCNotification(message)) {
+            state.instance.channel.deliver(message, { classification: opening.classification });
+            return;
+          }
+          state = {
+            phase: "pinned",
+            era: "modern",
+            instance: state.instance
+          };
+        } else {
+          const instance = await connectInstance("modern", opening.revision);
+          if (isTornDown()) {
+            await disposeLateInstance(instance);
+            return;
+          }
+          state = {
+            phase: "pinned",
+            era: "modern",
+            instance
+          };
+        }
+        if (await tryServeListen(message)) return;
+        state.instance.channel.deliver(message, { classification: opening.classification });
+        return;
+      case "legacy": {
+        if (legacyMode === "reject") {
+          if (isJSONRPCRequest(message)) await answerLegacyRejection(message, opening.reason, opening.requestedVersion);
+          return;
+        }
+        if (state.phase === "probe") {
+          await discardProbeInstance(state.instance);
+          if (isTornDown()) return;
+          state = { phase: "opening" };
+        }
+        const instance = await connectInstance("legacy");
+        if (isTornDown()) {
+          await disposeLateInstance(instance);
+          return;
+        }
+        state = {
+          phase: "pinned",
+          era: "legacy",
+          instance
+        };
+        state.instance.channel.deliver(message);
+        return;
+      }
+    }
+  };
+  const queue = [];
+  let pumping = false;
+  const pump = async () => {
+    if (pumping) return;
+    pumping = true;
+    try {
+      while (queue.length > 0) {
+        const message = queue.shift();
+        try {
+          await processMessage(message);
+        } catch (error62) {
+          if (isJSONRPCRequest(message)) await writeErrorResponse(message.id, ProtocolErrorCode.InternalError, "Internal server error");
+          reportError(toError(error62));
+        }
+      }
+    } finally {
+      pumping = false;
+    }
+  };
+  const closeAll = async () => {
+    if (closing || state.phase === "closed") return;
+    closing = true;
+    const current = state;
+    state = { phase: "closed" };
+    for (const result of listenRouter.teardownAll()) await wire.send(result).catch((error62) => reportError(toError(error62)));
+    if (current.phase === "probe" || current.phase === "pinned") await current.instance.product.close().catch((error62) => reportError(toError(error62)));
+    await wire.close().catch((error62) => reportError(toError(error62)));
+  };
+  wire.onmessage = (message) => {
+    queue.push(message);
+    pump();
+  };
+  wire.onerror = (error62) => {
+    reportError(error62);
+    if (state.phase === "probe" || state.phase === "pinned") state.instance.channel.onerror?.(error62);
+  };
+  wire.onclose = () => {
+    if (closing || state.phase === "closed") return;
+    closing = true;
+    const current = state;
+    state = { phase: "closed" };
+    if (current.phase === "probe" || current.phase === "pinned") current.instance.product.close().catch((error62) => reportError(toError(error62)));
+  };
+  const started = wire.start().catch((error62) => {
+    reportError(toError(error62));
+    throw error62;
+  });
+  started.catch(() => {
+  });
+  return { close: async () => {
+    await started.catch(() => {
+    });
+    await closeAll();
+  } };
+}
+function toError(value) {
+  return value instanceof Error ? value : new Error(String(value));
+}
 
 // node_modules/@chrischall/mcp-utils/dist/errors/index.js
 var DEFAULT_ERROR_MESSAGE_MAX = 500;
@@ -57103,17 +57763,73 @@ Hint: ${err.hint}`);
   }
   throw err;
 }
+function mcpRequestFrom(args) {
+  const ctx = args.at(-1);
+  if (typeof ctx !== "object" || ctx === null)
+    return void 0;
+  const req = ctx.mcpReq;
+  if (typeof req !== "object" || req === null)
+    return void 0;
+  return typeof req.notify === "function" ? req : void 0;
+}
+function callSignalFrom(args) {
+  const ctx = args.at(-1);
+  if (typeof ctx !== "object" || ctx === null)
+    return void 0;
+  const req = ctx.mcpReq;
+  if (typeof req !== "object" || req === null)
+    return void 0;
+  const signal = req.signal;
+  return signal instanceof AbortSignal ? signal : void 0;
+}
+function declaredCapabilitiesFrom(server) {
+  const inner = server.server;
+  if (typeof inner !== "object" || inner === null)
+    return void 0;
+  const read = inner.getClientCapabilities;
+  if (typeof read !== "function")
+    return void 0;
+  try {
+    const declared = read.call(inner);
+    return typeof declared === "object" && declared !== null ? declared : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function surfaceToolHints(server) {
   const register2 = server.registerTool.bind(server);
-  server.registerTool = (name, config2, cb) => register2(name, config2, (...args) => {
-    let result;
-    try {
-      result = cb(...args);
-    } catch (err) {
-      return hintResultOrRethrow(err);
-    }
-    return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
-  });
+  server.registerTool = (name, config2, cb) => register2(name, config2, (...args) => (
+    // THE CALLER'S CANCELLATION, made ambient for the whole handler
+    // (`cancel/index.ts`). The SDK delivers it and the fleet ignored it:
+    // measured against @modelcontextprotocol/server 2.0.0, a cancelled
+    // call aborts `ctx.mcpReq.signal` with the caller's reason and the
+    // handler runs to completion regardless — so the HTTP request stays
+    // in flight, the child keeps burning metered CPU, and the upstream
+    // keeps being hit for somebody who has gone. claude.ai sent 101
+    // cancellations in the week to 2026-09-20.
+    //
+    // Here because this is the one wrapper every tool already passes
+    // through: threading the signal by hand would mean editing several
+    // hundred handlers and missing exactly the ones nobody edits.
+    withCallSignal(callSignalFrom(args), () => (
+      // WHAT THE CALLER CAN DO, made ambient for the same reason and in
+      // the same place (`caller/index.ts`). Only the 2025-era half needs
+      // the wrapper — a 2026-07-28 request answers for itself off its own
+      // envelope — but a guarded tool that cannot tell whether the caller
+      // can be shown a prompt returns one the SDK then refuses to deliver,
+      // and that refusal reaches the caller as an unexplained protocol
+      // error it had no chance to catch.
+      withCallerCapabilities(declaredCapabilitiesFrom(server), () => {
+        let result;
+        try {
+          result = cb(...args);
+        } catch (err) {
+          return hintResultOrRethrow(err);
+        }
+        return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
+      })
+    ), mcpRequestFrom(args))
+  ));
 }
 async function createMcpServer(opts) {
   const server = new McpServer({ name: opts.name, version: opts.version }, { supportedProtocolVersions: [...SERVER_PROTOCOL_VERSIONS] });
@@ -57128,7 +57844,7 @@ async function createMcpServer(opts) {
   }
   return server;
 }
-function withGracefulShutdown(server, opts = {}) {
+function withGracefulShutdown(target, opts = {}) {
   const shouldExit = opts.exit ?? true;
   let shuttingDown = false;
   const handler = (signal) => {
@@ -57139,7 +57855,7 @@ function withGracefulShutdown(server, opts = {}) {
       try {
         if (opts.onSignal)
           await opts.onSignal(signal);
-        await server.close();
+        await target.close();
       } catch (err) {
         console.error(`[mcp-utils] error during graceful shutdown on ${signal}: ${err instanceof Error ? err.message : String(err)}`);
       } finally {
@@ -57151,16 +57867,26 @@ function withGracefulShutdown(server, opts = {}) {
   process.on("SIGINT", () => handler("SIGINT"));
   process.on("SIGTERM", () => handler("SIGTERM"));
 }
-async function runMcp(opts) {
-  const server = await createMcpServer(opts);
+function runMcp(opts) {
+  if (opts.banner !== void 0) {
+    console.error(opts.banner);
+  }
+  const spec = opts.transport ?? "stdio";
+  const handle = serveStdio(() => createMcpServer({ ...opts, banner: void 0 }), {
+    legacy: opts.legacy ?? "serve",
+    onerror: opts.onerror ?? ((error62) => {
+      console.error(`[mcp-utils] stdio server error: ${redactSecrets(error62.message)}`);
+    }),
+    // `'stdio'` means "let the entry make its own StdioServerTransport over
+    // this process"; anything else is the caller's transport, which the entry
+    // then owns (it starts it, pumps it, and closes it with the handle).
+    ...spec === "stdio" ? {} : { transport: spec }
+  });
   const shutdown = opts.shutdown ?? true;
   if (shutdown !== false) {
-    withGracefulShutdown(server, shutdown === true ? {} : shutdown);
+    withGracefulShutdown(handle, shutdown === true ? {} : shutdown);
   }
-  const spec = opts.transport ?? "stdio";
-  const transport = spec === "stdio" ? new StdioServerTransport() : spec;
-  await server.connect(transport);
-  return server;
+  return handle;
 }
 
 // node_modules/@chrischall/mcp-utils/dist/config/index.js
@@ -57256,12 +57982,13 @@ function toolAnnotations(opts = {}) {
     ...opts.title !== void 0 ? { title: opts.title } : {},
     readOnlyHint: opts.readOnly ?? true,
     ...opts.idempotent !== void 0 ? { idempotentHint: opts.idempotent } : {},
+    ...opts.destructive !== void 0 ? { destructiveHint: opts.destructive } : {},
     ...opts.openWorld !== void 0 ? { openWorldHint: opts.openWorld } : {}
   };
 }
 
 // src/version.ts
-var VERSION = "2.0.0";
+var VERSION = "2.1.1";
 
 // src/client.ts
 import { dirname, join } from "path";
@@ -58830,7 +59557,11 @@ function registerFriendActionTools(server, client2) {
       {
         title: action.title,
         description: `${action.detail} Acts on YOUR account and affects a real relationship with another person. Without confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it performs the action. Note: this endpoint path is taken from the Untappd app but is not otherwise independently verified.`,
-        annotations: toolAnnotations({ title: action.title, readOnly: false, idempotent: true, openWorld: true }),
+        // All four reach ANOTHER PERSON — the description says so itself: "affects
+        // a real relationship with another person". A friend request cannot be
+        // un-sent, and a rejection cannot be un-rejected, so none of them has an
+        // inverse in this tool set.
+        annotations: toolAnnotations({ title: action.title, readOnly: false, idempotent: true, openWorld: true, destructive: true }),
         inputSchema: external_exports.object({
           target_uid: TargetUidSchema,
           confirm: schemaConfirm
@@ -58860,7 +59591,7 @@ function registerWishlistTools(server, client2) {
     {
       title: "Add a beer to your wishlist",
       description: "Add a beer to YOUR Untappd wishlist by its bid. Without confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it adds. Writes to your account.",
-      annotations: toolAnnotations({ title: "Add a beer to your wishlist", readOnly: false, idempotent: true, openWorld: true }),
+      annotations: toolAnnotations({ title: "Add a beer to your wishlist", readOnly: false, idempotent: true, openWorld: true, destructive: false }),
       inputSchema: external_exports.object({
         bid: BidSchema2,
         confirm: schemaConfirm
@@ -58884,7 +59615,7 @@ function registerWishlistTools(server, client2) {
     {
       title: "Remove a beer from your wishlist",
       description: "Remove a beer from YOUR Untappd wishlist by its bid. Without confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it removes. Writes to your account.",
-      annotations: toolAnnotations({ title: "Remove a beer from your wishlist", readOnly: false, idempotent: true, openWorld: true }),
+      annotations: toolAnnotations({ title: "Remove a beer from your wishlist", readOnly: false, idempotent: true, openWorld: true, destructive: false }),
       inputSchema: external_exports.object({
         bid: BidSchema2,
         confirm: schemaConfirm
@@ -58926,7 +59657,7 @@ function registerCheckinTools(server, client2) {
     {
       title: "Toast an Untappd check-in",
       description: "Toast (like) a check-in on YOUR account. This endpoint is a TOGGLE: calling it on a check-in you have already toasted removes the toast. Without confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it posts. Writes to your Untappd account and is visible to others.",
-      annotations: toolAnnotations({ title: "Toast an Untappd check-in", readOnly: false, idempotent: false, openWorld: true }),
+      annotations: toolAnnotations({ title: "Toast an Untappd check-in", readOnly: false, idempotent: false, openWorld: true, destructive: false }),
       inputSchema: external_exports.object({
         checkin_id: CheckinIdSchema,
         confirm: schemaConfirm
@@ -58950,7 +59681,7 @@ function registerCheckinTools(server, client2) {
     {
       title: "Comment on an Untappd check-in",
       description: "Post a comment on a check-in from YOUR account. Without confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it posts. Writes to your Untappd account and is visible to others.",
-      annotations: toolAnnotations({ title: "Comment on an Untappd check-in", readOnly: false, idempotent: false, openWorld: true }),
+      annotations: toolAnnotations({ title: "Comment on an Untappd check-in", readOnly: false, idempotent: false, openWorld: true, destructive: false }),
       inputSchema: external_exports.object({
         checkin_id: CheckinIdSchema,
         comment: external_exports.string().min(1).max(2e3).describe("Comment text to post"),
@@ -58976,7 +59707,7 @@ function registerCheckinTools(server, client2) {
     {
       title: "Delete a comment from an Untappd check-in",
       description: "Delete one of YOUR comments by its comment id (the id from a check-in's comments list). Without confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it deletes.",
-      annotations: toolAnnotations({ title: "Delete a comment from an Untappd check-in", readOnly: false, idempotent: true, openWorld: true }),
+      annotations: toolAnnotations({ title: "Delete a comment from an Untappd check-in", readOnly: false, idempotent: true, openWorld: true, destructive: true }),
       inputSchema: external_exports.object({
         comment_id: external_exports.number().int().positive().describe("Untappd comment id (from a check-in's comments.items)"),
         confirm: schemaConfirm
@@ -59000,7 +59731,7 @@ function registerCheckinTools(server, client2) {
     {
       title: "Delete an Untappd check-in",
       description: "Permanently delete one of YOUR check-ins by its id. This is destructive and cannot be undone. Without confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it deletes.",
-      annotations: toolAnnotations({ title: "Delete an Untappd check-in", readOnly: false, idempotent: true, openWorld: true }),
+      annotations: toolAnnotations({ title: "Delete an Untappd check-in", readOnly: false, idempotent: true, openWorld: true, destructive: true }),
       inputSchema: external_exports.object({
         checkin_id: CheckinIdSchema,
         confirm: schemaConfirm
@@ -59024,7 +59755,7 @@ function registerCheckinTools(server, client2) {
     {
       title: "Check in a beer on Untappd",
       description: "Post a NEW beer check-in to YOUR Untappd account \u2014 this publishes to your public feed. Provide the beer id (bid) from untappd_search_beer; optionally a rating (0\u20135 in 0.25 steps), a shout (comment), a venue via foursquare_id, and a local photo via photo_path (JPEG/PNG). Without confirm: true it returns a dry-run preview of the exact fields and makes NO network call; with confirm: true it posts.",
-      annotations: toolAnnotations({ title: "Check in a beer on Untappd", readOnly: false, idempotent: false, openWorld: true }),
+      annotations: toolAnnotations({ title: "Check in a beer on Untappd", readOnly: false, idempotent: false, openWorld: true, destructive: false }),
       inputSchema: external_exports.object({
         bid: external_exports.number().int().positive().describe("Untappd beer id to check in (from untappd_search_beer)"),
         rating: RatingSchema.optional().describe("Rating 0\u20135 in 0.25 increments (omit for no rating)"),
@@ -59538,7 +60269,7 @@ function registerCacheTools(server, client2, cacheProvider) {
     {
       title: "Sync a user's check-ins into the cache",
       description: "Fetch a user's detailed check-ins (venue, date, comment) into the cache from user/checkins. Incremental and resumable: pages backwards up to max_pages per call, persisting progress every page; run again until another_run_needed is false. NOTE: Untappd only returns the ~50 most recent check-ins for accounts other than your own and will not page further \u2014 such a sync reports history_truncated and you should use untappd_sync_user_beers for full has-had coverage. backfill_complete is only reported once ~all of total_checkins is cached. Pass force_backfill: true to reset a cache wrongly marked complete and re-page the whole history (cached rows are kept). Omit username for your own account.",
-      annotations: toolAnnotations({ title: "Sync a user's check-ins into the cache", readOnly: false, idempotent: false, openWorld: true }),
+      annotations: toolAnnotations({ title: "Sync a user's check-ins into the cache", readOnly: false, idempotent: false, openWorld: true, destructive: false }),
       inputSchema: external_exports.object({
         username: UsernameArg2,
         max_pages: external_exports.number().int().min(1).max(50).optional().describe("Pages (50 check-ins each) to fetch this run (default 10). Keep modest to respect the ~100 calls/hour rate limit."),
@@ -59559,7 +60290,7 @@ function registerCacheTools(server, client2, cacheProvider) {
     {
       title: "Sync a user's complete distinct-beers list into the cache",
       description: `Fetch a user's COMPLETE distinct-beers list (every unique beer they've ever had, with their rating, times-had count, and first/last dates) into the cache from user/beers. This is the cheapest way to get full "has had" coverage \u2014 thousands of beers instead of tens of thousands of check-ins \u2014 and, unlike user/checkins, it pages fully for any public/friend account. Offset-paged and resumable: fetches max_pages per call and persists progress; run again until another_run_needed is false. Feeds the same untappd_cache_has_had / has_had_many / not_had tools. Omit username for your own account.`,
-      annotations: toolAnnotations({ title: "Sync a user's complete distinct-beers list into the cache", readOnly: false, idempotent: false, openWorld: true }),
+      annotations: toolAnnotations({ title: "Sync a user's complete distinct-beers list into the cache", readOnly: false, idempotent: false, openWorld: true, destructive: false }),
       inputSchema: external_exports.object({
         username: UsernameArg2,
         max_pages: external_exports.number().int().min(1).max(50).optional().describe("Pages (50 beers each) to fetch this run (default 10). Keep modest to respect the ~100 calls/hour rate limit.")
@@ -59693,7 +60424,7 @@ function registerCacheTools(server, client2, cacheProvider) {
     {
       title: "Top-rated beers a user has NOT had, from a candidate list",
       description: 'The "what should I order off this tap list?" tool. From a list of candidate beer ids, return the top N the user has NOT yet had, ranked by Untappd global rating, with an optional style filter. Not-had filtering uses the cache only (both sources, no API call). Beer ratings/styles come from a metadata cache; a beer/info API call is made only on a cache miss or if the cached metadata is >30 days old, capped at api_budget calls per run (~100 calls/hour limit) \u2014 if more are needed it returns partial: true / another_run_needed: true, so re-running fills the rest. Reports the same freshness/caveat block as untappd_cache_not_had. Omit username for your own account.',
-      annotations: toolAnnotations({ title: "Top-rated beers a user has NOT had, from a candidate list", readOnly: false, idempotent: false, openWorld: true }),
+      annotations: toolAnnotations({ title: "Top-rated beers a user has NOT had, from a candidate list", readOnly: false, idempotent: false, openWorld: true, destructive: false }),
       inputSchema: external_exports.object({
         username: UsernameArg2,
         bids: external_exports.array(external_exports.number().int().positive()).min(1).max(100).describe("Candidate beer ids (1\u2013100)"),

package/dist/tools/cache.js

@@ -92,7 +92,7 @@ export function registerCacheTools(server, client, cacheProvider) {
             'untappd_sync_user_beers for full has-had coverage. backfill_complete is only reported once ~all of ' +
             'total_checkins is cached. Pass force_backfill: true to reset a cache wrongly marked complete and re-page ' +
             'the whole history (cached rows are kept). Omit username for your own account.',
-        annotations: toolAnnotations({ title: "Sync a user's check-ins into the cache", readOnly: false, idempotent: false, openWorld: true }),
+        annotations: toolAnnotations({ title: "Sync a user's check-ins into the cache", readOnly: false, idempotent: false, openWorld: true, destructive: false }),
         inputSchema: z.object({
             username: UsernameArg,
             max_pages: z
@@ -123,7 +123,7 @@ export function registerCacheTools(server, client, cacheProvider) {
             'user/checkins, it pages fully for any public/friend account. Offset-paged and resumable: fetches max_pages ' +
             'per call and persists progress; run again until another_run_needed is false. Feeds the same ' +
             'untappd_cache_has_had / has_had_many / not_had tools. Omit username for your own account.',
-        annotations: toolAnnotations({ title: "Sync a user's complete distinct-beers list into the cache", readOnly: false, idempotent: false, openWorld: true }),
+        annotations: toolAnnotations({ title: "Sync a user's complete distinct-beers list into the cache", readOnly: false, idempotent: false, openWorld: true, destructive: false }),
         inputSchema: z.object({
             username: UsernameArg,
             max_pages: z
@@ -271,7 +271,7 @@ export function registerCacheTools(server, client, cacheProvider) {
             'run (~100 calls/hour limit) — if more are needed it returns partial: true / another_run_needed: true, so ' +
             're-running fills the rest. Reports the same freshness/caveat block as untappd_cache_not_had. Omit username ' +
             'for your own account.',
-        annotations: toolAnnotations({ title: 'Top-rated beers a user has NOT had, from a candidate list', readOnly: false, idempotent: false, openWorld: true }),
+        annotations: toolAnnotations({ title: 'Top-rated beers a user has NOT had, from a candidate list', readOnly: false, idempotent: false, openWorld: true, destructive: false }),
         inputSchema: z.object({
             username: UsernameArg,
             bids: z.array(z.number().int().positive()).min(1).max(100).describe('Candidate beer ids (1–100)'),

package/dist/tools/checkin.js

@@ -28,7 +28,7 @@ export function registerCheckinTools(server, client) {
         description: "Toast (like) a check-in on YOUR account. This endpoint is a TOGGLE: calling it on a check-in you have " +
             'already toasted removes the toast. Without confirm: true it returns a dry-run preview and makes NO network ' +
             'call; with confirm: true it posts. Writes to your Untappd account and is visible to others.',
-        annotations: toolAnnotations({ title: 'Toast an Untappd check-in', readOnly: false, idempotent: false, openWorld: true }),
+        annotations: toolAnnotations({ title: 'Toast an Untappd check-in', readOnly: false, idempotent: false, openWorld: true, destructive: false }),
         inputSchema: z.object({
             checkin_id: CheckinIdSchema,
             confirm: schemaConfirm,
@@ -49,7 +49,7 @@ export function registerCheckinTools(server, client) {
         title: 'Comment on an Untappd check-in',
         description: 'Post a comment on a check-in from YOUR account. Without confirm: true it returns a dry-run preview and ' +
             'makes NO network call; with confirm: true it posts. Writes to your Untappd account and is visible to others.',
-        annotations: toolAnnotations({ title: 'Comment on an Untappd check-in', readOnly: false, idempotent: false, openWorld: true }),
+        annotations: toolAnnotations({ title: 'Comment on an Untappd check-in', readOnly: false, idempotent: false, openWorld: true, destructive: false }),
         inputSchema: z.object({
             checkin_id: CheckinIdSchema,
             comment: z.string().min(1).max(2000).describe('Comment text to post'),
@@ -72,7 +72,7 @@ export function registerCheckinTools(server, client) {
         title: 'Delete a comment from an Untappd check-in',
         description: 'Delete one of YOUR comments by its comment id (the id from a check-in\'s comments list). Without ' +
             'confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it deletes.',
-        annotations: toolAnnotations({ title: 'Delete a comment from an Untappd check-in', readOnly: false, idempotent: true, openWorld: true }),
+        annotations: toolAnnotations({ title: 'Delete a comment from an Untappd check-in', readOnly: false, idempotent: true, openWorld: true, destructive: true }),
         inputSchema: z.object({
             comment_id: z.number().int().positive().describe('Untappd comment id (from a check-in\'s comments.items)'),
             confirm: schemaConfirm,
@@ -93,7 +93,7 @@ export function registerCheckinTools(server, client) {
         title: 'Delete an Untappd check-in',
         description: 'Permanently delete one of YOUR check-ins by its id. This is destructive and cannot be undone. Without ' +
             'confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it deletes.',
-        annotations: toolAnnotations({ title: 'Delete an Untappd check-in', readOnly: false, idempotent: true, openWorld: true }),
+        annotations: toolAnnotations({ title: 'Delete an Untappd check-in', readOnly: false, idempotent: true, openWorld: true, destructive: true }),
         inputSchema: z.object({
             checkin_id: CheckinIdSchema,
             confirm: schemaConfirm,
@@ -116,7 +116,7 @@ export function registerCheckinTools(server, client) {
             '(bid) from untappd_search_beer; optionally a rating (0–5 in 0.25 steps), a shout (comment), a venue via ' +
             'foursquare_id, and a local photo via photo_path (JPEG/PNG). Without confirm: true it returns a dry-run ' +
             'preview of the exact fields and makes NO network call; with confirm: true it posts.',
-        annotations: toolAnnotations({ title: 'Check in a beer on Untappd', readOnly: false, idempotent: false, openWorld: true }),
+        annotations: toolAnnotations({ title: 'Check in a beer on Untappd', readOnly: false, idempotent: false, openWorld: true, destructive: false }),
         inputSchema: z.object({
             bid: z.number().int().positive().describe('Untappd beer id to check in (from untappd_search_beer)'),
             rating: RatingSchema.optional().describe('Rating 0–5 in 0.25 increments (omit for no rating)'),

package/dist/tools/friends.js

@@ -50,7 +50,11 @@ export function registerFriendActionTools(server, client) {
                 'Without confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it ' +
                 'performs the action. Note: this endpoint path is taken from the Untappd app but is not otherwise ' +
                 'independently verified.',
-            annotations: toolAnnotations({ title: action.title, readOnly: false, idempotent: true, openWorld: true }),
+            // All four reach ANOTHER PERSON — the description says so itself: "affects
+            // a real relationship with another person". A friend request cannot be
+            // un-sent, and a rejection cannot be un-rejected, so none of them has an
+            // inverse in this tool set.
+            annotations: toolAnnotations({ title: action.title, readOnly: false, idempotent: true, openWorld: true, destructive: true }),
             inputSchema: z.object({
                 target_uid: TargetUidSchema,
                 confirm: schemaConfirm,

package/dist/tools/wishlist.js

@@ -6,7 +6,7 @@ export function registerWishlistTools(server, client) {
         title: 'Add a beer to your wishlist',
         description: 'Add a beer to YOUR Untappd wishlist by its bid. Without confirm: true it returns a dry-run preview and ' +
             'makes NO network call; with confirm: true it adds. Writes to your account.',
-        annotations: toolAnnotations({ title: 'Add a beer to your wishlist', readOnly: false, idempotent: true, openWorld: true }),
+        annotations: toolAnnotations({ title: 'Add a beer to your wishlist', readOnly: false, idempotent: true, openWorld: true, destructive: false }),
         inputSchema: z.object({
             bid: BidSchema,
             confirm: schemaConfirm,
@@ -27,7 +27,7 @@ export function registerWishlistTools(server, client) {
         title: 'Remove a beer from your wishlist',
         description: 'Remove a beer from YOUR Untappd wishlist by its bid. Without confirm: true it returns a dry-run preview ' +
             'and makes NO network call; with confirm: true it removes. Writes to your account.',
-        annotations: toolAnnotations({ title: 'Remove a beer from your wishlist', readOnly: false, idempotent: true, openWorld: true }),
+        annotations: toolAnnotations({ title: 'Remove a beer from your wishlist', readOnly: false, idempotent: true, openWorld: true, destructive: false }),
         inputSchema: z.object({
             bid: BidSchema,
             confirm: schemaConfirm,

package/dist/version.js

@@ -3,4 +3,4 @@
 // json's `extra-files`), and `versionSyncTest` guards that it stays equal to
 // package.json. Import VERSION wherever the version is needed rather than
 // re-declaring it.
-export const VERSION = '2.0.0'; // x-release-please-version
+export const VERSION = '2.1.1'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "untappd-mcp",
-  "version": "2.0.0",
+  "version": "2.1.1",
   "mcpName": "io.github.chrischall/untappd-mcp",
   "description": "Untappd MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -45,7 +45,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.28.0",
+    "@chrischall/mcp-utils": "^2.2.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "ai": "^7.0.19",
     "dotenv": "^17.4.0",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/untappd-mcp",
     "source": "github"
   },
-  "version": "2.0.0",
+  "version": "2.1.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "untappd-mcp",
-      "version": "2.0.0",
+      "version": "2.1.1",
       "transport": {
         "type": "stdio"
       },