untappd-mcp 2.1.0 → 2.1.2

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Untappd — beers, breweries, venues, check-ins, wishlists, and your friend feed",
-    "version": "2.1.0"
+    "version": "2.1.2"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Untappd",
       "source": "./",
       "description": "MCP server for Untappd — search beers/breweries/venues, read profiles/check-ins/wishlists, and post check-ins, toasts, and comments",
-      "version": "2.1.0",
+      "version": "2.1.2",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "untappd-mcp",
   "displayName": "Untappd",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "description": "MCP server for Untappd — search beers/breweries/venues, read check-ins and wishlists, and post check-ins, toasts, and comments",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -2282,7 +2282,7 @@ var require_versions = __commonJS({
     exports.version = {
       major: 4,
       minor: 6,
-      patch: 4
+      patch: 5
     };
     (function() {
       var keys = Object.getOwnPropertyNames(exports);
@@ -4851,7 +4851,7 @@ var require_memoizer = __commonJS({
     var NONE2 = 0;
     var ASSUMED2 = 1;
     var PROVEN2 = 2;
-    function isRecursive2(inst, stack, resolve) {
+    function isRecursive2(inst, stack, resolve3) {
       const cached2 = recursive2.get(inst);
       if (cached2 !== void 0)
         return cached2 ? PROVEN2 : NONE2;
@@ -4861,7 +4861,7 @@ var require_memoizer = __commonJS({
       let result = NONE2;
       const check2 = (child) => {
         if (result !== PROVEN2 && child?._zod) {
-          const answer = isRecursive2(child, stack, resolve);
+          const answer = isRecursive2(child, stack, resolve3);
           if (answer > result)
             result = answer;
         }
@@ -4872,7 +4872,7 @@ var require_memoizer = __commonJS({
           const desc = Object.getOwnPropertyDescriptor(sh, key);
           if (spread && !desc.enumerable)
             continue;
-          const child = desc.get ? ASSUMED2 : desc.value?._zod ? isRecursive2(desc.value, stack, resolve) : NONE2;
+          const child = desc.get ? ASSUMED2 : desc.value?._zod ? isRecursive2(desc.value, stack, resolve3) : NONE2;
           if (child > answer)
             answer = child;
         }
@@ -4936,7 +4936,7 @@ var require_memoizer = __commonJS({
           break;
         // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
         case "lazy": {
-          const inner = def._cachedInner ?? (resolve ? inst._zod.innerType : void 0);
+          const inner = def._cachedInner ?? (resolve3 ? inst._zod.innerType : void 0);
           merge2(inner ? isRecursive2(inner, stack, false) : ASSUMED2);
           break;
         }
@@ -23302,6 +23302,20 @@ var require_v4 = __commonJS({
   }
 });
 
+// node_modules/@chrischall/mcp-utils/dist/cancel/index.js
+import { AsyncLocalStorage } from "node:async_hooks";
+var storage = new AsyncLocalStorage();
+function withCallSignal(signal, fn, request) {
+  return signal ? storage.run({ signal, ...request ? { request } : {} }, fn) : fn();
+}
+
+// node_modules/@chrischall/mcp-utils/dist/caller/index.js
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var storage2 = new AsyncLocalStorage2();
+function withCallerCapabilities(capabilities, fn) {
+  return capabilities ? storage2.run(capabilities, fn) : fn();
+}
+
 // node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create2 = Object.create;
 var __defProp2 = Object.defineProperty;
@@ -27704,14 +27718,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep(ms, signal) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve();
+      resolve3();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -28505,7 +28519,7 @@ var Protocol = class {
     const flowStartedAt = Date.now();
     let onAbort;
     let cleanupMessageId;
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve3, reject) => {
       const earlyReject = (error62) => {
         reject(error62);
       };
@@ -28573,7 +28587,7 @@ var Protocol = class {
         }
         if (decoded.kind === "invalid") return reject(decoded.error);
         if (decoded.kind === "input_required") {
-          if (options?.allowInputRequired === true) return resolve(manualInputRequiredValue(decoded));
+          if (options?.allowInputRequired === true) return resolve3(manualInputRequiredValue(decoded));
           const flow = {
             codec: codec2,
             request,
@@ -28585,11 +28599,11 @@ var Protocol = class {
               params
             }, resultSchema, legOptions)
           };
-          return resolve(this._resolveNonCompleteResult(decoded, flow));
+          return resolve3(this._resolveNonCompleteResult(decoded, flow));
         }
         const result = decoded.result;
         validateStandardSchema(resultSchema, result).then((parseResult) => {
-          if (parseResult.success) resolve(parseResult.data);
+          if (parseResult.success) resolve3(parseResult.data);
           else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
         }, reject);
       });
@@ -31501,7 +31515,7 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin(((exports) => {
     ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
     const schOrFunc = root.refs[ref];
     if (schOrFunc) return schOrFunc;
-    let _sch = resolve.call(this, root, ref);
+    let _sch = resolve3.call(this, root, ref);
     if (_sch === void 0) {
       const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
       const { schemaId } = this.opts;
@@ -31527,7 +31541,7 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin(((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve(root, ref) {
+  function resolve3(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string") ref = sch;
     return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -31977,47 +31991,47 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     else if (typeof uri === "object") uri = parse3(serialize(uri, options), options);
     return uri;
   }
-  function resolve(baseURI, relativeURI, options) {
+  function resolve3(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
     return serialize(resolved, schemelessOptions);
   }
-  function resolveComponent(base, relative, options, skipNormalization) {
+  function resolveComponent(base, relative2, options, skipNormalization) {
     const target = {};
     if (!skipNormalization) {
       base = parse3(serialize(base, options), options);
-      relative = parse3(serialize(relative, options), options);
+      relative2 = parse3(serialize(relative2, options), options);
     }
     options = options || {};
-    if (!options.tolerant && relative.scheme) {
-      target.scheme = relative.scheme;
-      target.userinfo = relative.userinfo;
-      target.host = relative.host;
-      target.port = relative.port;
-      target.path = removeDotSegments(relative.path || "");
-      target.query = relative.query;
+    if (!options.tolerant && relative2.scheme) {
+      target.scheme = relative2.scheme;
+      target.userinfo = relative2.userinfo;
+      target.host = relative2.host;
+      target.port = relative2.port;
+      target.path = removeDotSegments(relative2.path || "");
+      target.query = relative2.query;
     } else {
-      if (relative.userinfo !== void 0 || relative.host !== void 0 || relative.port !== void 0) {
-        target.userinfo = relative.userinfo;
-        target.host = relative.host;
-        target.port = relative.port;
-        target.path = removeDotSegments(relative.path || "");
-        target.query = relative.query;
+      if (relative2.userinfo !== void 0 || relative2.host !== void 0 || relative2.port !== void 0) {
+        target.userinfo = relative2.userinfo;
+        target.host = relative2.host;
+        target.port = relative2.port;
+        target.path = removeDotSegments(relative2.path || "");
+        target.query = relative2.query;
       } else {
-        if (!relative.path) {
+        if (!relative2.path) {
           target.path = base.path;
-          if (relative.query !== void 0) target.query = relative.query;
+          if (relative2.query !== void 0) target.query = relative2.query;
           else target.query = base.query;
         } else {
-          if (relative.path[0] === "/") target.path = removeDotSegments(relative.path);
+          if (relative2.path[0] === "/") target.path = removeDotSegments(relative2.path);
           else {
-            if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative.path;
-            else if (!base.path) target.path = relative.path;
-            else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
+            if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative2.path;
+            else if (!base.path) target.path = relative2.path;
+            else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative2.path;
             target.path = removeDotSegments(target.path);
           }
-          target.query = relative.query;
+          target.query = relative2.query;
         }
         target.userinfo = base.userinfo;
         target.host = base.host;
@@ -32025,7 +32039,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
       }
       target.scheme = base.scheme;
     }
-    target.fragment = relative.fragment;
+    target.fragment = relative2.fragment;
     return target;
   }
   function equal(uriA, uriB, options) {
@@ -32151,7 +32165,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
   const fastUri = {
     SCHEMES,
     normalize,
-    resolve,
+    resolve: resolve3,
     resolveComponent,
     equal,
     serialize,
@@ -37524,7 +37538,7 @@ var StdioServerTransport = class {
   }
   send(message) {
     if (this._closed) return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve3, reject) => {
       const json2 = serializeMessage(message);
       let settled = false;
       const onError = (error62) => {
@@ -37539,14 +37553,14 @@ var StdioServerTransport = class {
         settled = true;
         this._stdout.off("error", onError);
         this._stdout.off("drain", onDrain);
-        resolve();
+        resolve3();
       };
       this._stdout.once("error", onError);
       if (this._stdout.write(json2)) {
         if (settled) return;
         settled = true;
         this._stdout.off("error", onError);
-        resolve();
+        resolve3();
       } else if (!settled) this._stdout.once("drain", onDrain);
     });
   }
@@ -37600,14 +37614,14 @@ var StdioConnectionChannel = class {
   */
   async whenRequestsAnswered(timeoutMs) {
     if (this._closed || this._pendingRequests.size === 0) return true;
-    return await new Promise((resolve) => {
+    return await new Promise((resolve3) => {
       const waiter = () => {
         clearTimeout(timer);
-        resolve(true);
+        resolve3(true);
       };
       const timer = setTimeout(() => {
         this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
-        resolve(false);
+        resolve3(false);
       }, timeoutMs);
       this._drainWaiters.push(waiter);
     });
@@ -38005,13 +38019,28 @@ var API_KEY_RE = new RegExp([
   "whsec_[A-Za-z0-9]{16,}\\b"
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
-var QUERY_SECRET_RE = /([?&](?:access_token|refresh_token|client_secret|api_?key|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var QUERY_SECRET_RE = /([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
+var FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
+var HEADER_SECRET_RE = /(\b(?:x[-_][a-z0-9_-]*?(?:api[-_]?key|token|secret|auth)[a-z0-9_-]*|api[-_]?key)\s*:\s*)[^\s,;"'<>`]+/gi;
 var AWS_SIGV4_RE = /([?&]X-Amz-(?:Signature|Security-Token|Credential)=)[^&#\s"'<>`]+/gi;
-var JSON_SECRET_KEYS = "access_token|refresh_token|client_secret|api_?key|password|passwd|secret|token";
-var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")[^"]*(")`, "gi");
-var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')[^']*(')`, "gi");
+var JSON_SECRET_KEYS = [
+  "(?:access|refresh|id|auth|session|bearer|csrf|xsrf)[_-]?token",
+  "client[_-]?secret",
+  "api[_-]?secret",
+  "(?:x[_-])?api[_-]?key",
+  "private[_-]?key",
+  "x[_-][a-z0-9_-]*?(?:api[_-]?key|token|secret|auth)[a-z0-9_-]*",
+  "(?:proxy-)?authorization",
+  "password",
+  "passwd",
+  "secret",
+  "token"
+].join("|");
+var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")(?:[^"\\\\]|\\\\.)*(")`, "gi");
+var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')(?:[^'\\\\]|\\\\.)*(')`, "gi");
 function redactSecrets(text) {
-  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
+  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(HEADER_SECRET_RE, "$1[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(OAUTH_CODE_RE, "$1[REDACTED]").replace(FORM_PASSWORD_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
 }
 function truncateErrorMessage(text, max = DEFAULT_ERROR_MESSAGE_MAX) {
   const str2 = text === null || text === void 0 ? "" : String(text);
@@ -40616,7 +40645,7 @@ ${content.join("\n")}
 var version = {
   major: 4,
   minor: 6,
-  patch: 4
+  patch: 5
 };
 
 // node_modules/zod/v4/core/schemas.js
@@ -43052,7 +43081,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve) {
+function isRecursive(inst, stack, resolve3) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -43062,7 +43091,7 @@ function isRecursive(inst, stack, resolve) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve);
+      const answer = isRecursive(child, stack, resolve3);
       if (answer > result)
         result = answer;
     }
@@ -43073,7 +43102,7 @@ function isRecursive(inst, stack, resolve) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve3) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -43137,7 +43166,7 @@ function isRecursive(inst, stack, resolve) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve3 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -57749,17 +57778,73 @@ Hint: ${err.hint}`);
   }
   throw err;
 }
+function mcpRequestFrom(args) {
+  const ctx = args.at(-1);
+  if (typeof ctx !== "object" || ctx === null)
+    return void 0;
+  const req = ctx.mcpReq;
+  if (typeof req !== "object" || req === null)
+    return void 0;
+  return typeof req.notify === "function" ? req : void 0;
+}
+function callSignalFrom(args) {
+  const ctx = args.at(-1);
+  if (typeof ctx !== "object" || ctx === null)
+    return void 0;
+  const req = ctx.mcpReq;
+  if (typeof req !== "object" || req === null)
+    return void 0;
+  const signal = req.signal;
+  return signal instanceof AbortSignal ? signal : void 0;
+}
+function declaredCapabilitiesFrom(server) {
+  const inner = server.server;
+  if (typeof inner !== "object" || inner === null)
+    return void 0;
+  const read = inner.getClientCapabilities;
+  if (typeof read !== "function")
+    return void 0;
+  try {
+    const declared = read.call(inner);
+    return typeof declared === "object" && declared !== null ? declared : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function surfaceToolHints(server) {
   const register2 = server.registerTool.bind(server);
-  server.registerTool = (name, config2, cb) => register2(name, config2, (...args) => {
-    let result;
-    try {
-      result = cb(...args);
-    } catch (err) {
-      return hintResultOrRethrow(err);
-    }
-    return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
-  });
+  server.registerTool = (name, config2, cb) => register2(name, config2, (...args) => (
+    // THE CALLER'S CANCELLATION, made ambient for the whole handler
+    // (`cancel/index.ts`). The SDK delivers it and the fleet ignored it:
+    // measured against @modelcontextprotocol/server 2.0.0, a cancelled
+    // call aborts `ctx.mcpReq.signal` with the caller's reason and the
+    // handler runs to completion regardless — so the HTTP request stays
+    // in flight, the child keeps burning metered CPU, and the upstream
+    // keeps being hit for somebody who has gone. claude.ai sent 101
+    // cancellations in the week to 2026-09-20.
+    //
+    // Here because this is the one wrapper every tool already passes
+    // through: threading the signal by hand would mean editing several
+    // hundred handlers and missing exactly the ones nobody edits.
+    withCallSignal(callSignalFrom(args), () => (
+      // WHAT THE CALLER CAN DO, made ambient for the same reason and in
+      // the same place (`caller/index.ts`). Only the 2025-era half needs
+      // the wrapper — a 2026-07-28 request answers for itself off its own
+      // envelope — but a guarded tool that cannot tell whether the caller
+      // can be shown a prompt returns one the SDK then refuses to deliver,
+      // and that refusal reaches the caller as an unexplained protocol
+      // error it had no chance to catch.
+      withCallerCapabilities(declaredCapabilitiesFrom(server), () => {
+        let result;
+        try {
+          result = cb(...args);
+        } catch (err) {
+          return hintResultOrRethrow(err);
+        }
+        return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
+      })
+    ), mcpRequestFrom(args))
+  ));
 }
 async function createMcpServer(opts) {
   const server = new McpServer({ name: opts.name, version: opts.version }, { supportedProtocolVersions: [...SERVER_PROTOCOL_VERSIONS] });
@@ -57774,13 +57859,47 @@ async function createMcpServer(opts) {
   }
   return server;
 }
+var DEFAULT_SHUTDOWN_TIMEOUT_MS = 5e3;
+var DEFAULT_REPEAT_SIGNAL_GRACE_MS = 500;
 function withGracefulShutdown(target, opts = {}) {
   const shouldExit = opts.exit ?? true;
+  if (opts.timeoutMs !== void 0 && !(Number.isFinite(opts.timeoutMs) && opts.timeoutMs > 0)) {
+    throw new RangeError("withGracefulShutdown: timeoutMs must be a finite number greater than 0.");
+  }
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS;
+  if (opts.repeatSignalGraceMs !== void 0 && !(Number.isFinite(opts.repeatSignalGraceMs) && opts.repeatSignalGraceMs >= 0)) {
+    throw new RangeError("withGracefulShutdown: repeatSignalGraceMs must be a finite number >= 0.");
+  }
+  const repeatGraceMs = opts.repeatSignalGraceMs ?? DEFAULT_REPEAT_SIGNAL_GRACE_MS;
   let shuttingDown = false;
+  let firstSignalAt = 0;
+  let exited = false;
+  const exitOnce = () => {
+    if (exited)
+      return;
+    exited = true;
+    process.exit(0);
+  };
   const handler = (signal) => {
-    if (shuttingDown)
+    if (shuttingDown) {
+      if (Date.now() - firstSignalAt < repeatGraceMs)
+        return;
+      if (shouldExit) {
+        console.error(`[mcp-utils] second ${signal} during shutdown \u2014 exiting now`);
+        exitOnce();
+      }
       return;
+    }
     shuttingDown = true;
+    firstSignalAt = Date.now();
+    let timer;
+    if (shouldExit) {
+      timer = setTimeout(() => {
+        console.error(`[mcp-utils] graceful shutdown on ${signal} did not finish in ${timeoutMs}ms \u2014 exiting`);
+        exitOnce();
+      }, timeoutMs);
+      timer.unref?.();
+    }
     void (async () => {
       try {
         if (opts.onSignal)
@@ -57789,8 +57908,10 @@ function withGracefulShutdown(target, opts = {}) {
       } catch (err) {
         console.error(`[mcp-utils] error during graceful shutdown on ${signal}: ${err instanceof Error ? err.message : String(err)}`);
       } finally {
+        if (timer !== void 0)
+          clearTimeout(timer);
         if (shouldExit)
-          process.exit(0);
+          exitOnce();
       }
     })();
   };
@@ -57820,6 +57941,8 @@ function runMcp(opts) {
 }
 
 // node_modules/@chrischall/mcp-utils/dist/config/index.js
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
 var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
 function readEnvVar(key, opts = {}) {
   const env = opts.env ?? process.env;
@@ -57832,6 +57955,15 @@ function readEnvVar(key, opts = {}) {
   }
   return opts.default;
 }
+function expandPath(p) {
+  let expanded = p;
+  if (p === "~") {
+    expanded = homedir();
+  } else if (p.startsWith("~/")) {
+    expanded = join(homedir(), p.slice(2));
+  }
+  return isAbsolute(expanded) ? expanded : resolve(expanded);
+}
 async function loadDotenvSafely(opts = {}) {
   try {
     const mod = await import(
@@ -57851,10 +57983,48 @@ async function loadDotenvSafely(opts = {}) {
 
 // node_modules/@chrischall/mcp-utils/dist/fs/index.js
 import { openAsBlob } from "node:fs";
+
+// node_modules/@chrischall/mcp-utils/dist/fs/confine.js
+import { existsSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute as isAbsolute2, relative, resolve as resolve2, sep } from "node:path";
+function isInside(root, target) {
+  const rel = relative(root, target);
+  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute2(rel);
+}
+function realPathAllowingMissing(p) {
+  const abs = resolve2(p);
+  let existing = abs;
+  const tail = [];
+  while (!existsSync(existing)) {
+    const parent = dirname(existing);
+    if (parent === existing)
+      break;
+    tail.unshift(existing.slice(parent.length).replace(/^[/\\]+/, ""));
+    existing = parent;
+  }
+  let real;
+  try {
+    real = realpathSync(existing);
+  } catch {
+    real = existing;
+  }
+  return tail.length > 0 ? resolve2(real, ...tail) : real;
+}
+function assertPathWithinRoots(path, roots) {
+  const target = realPathAllowingMissing(expandPath(path));
+  for (const root of roots) {
+    if (isInside(realPathAllowingMissing(expandPath(root)), target))
+      return target;
+  }
+  throw new Error(`Path is outside the allowed directories: ${path}`);
+}
+
+// node_modules/@chrischall/mcp-utils/dist/fs/index.js
 async function fileBlob(path, opts = {}) {
+  const target = opts.allowedRoots ? assertPathWithinRoots(path, opts.allowedRoots) : path;
   let blob;
   try {
-    blob = await openAsBlob(path, opts.type !== void 0 ? { type: opts.type } : void 0);
+    blob = await openAsBlob(target, opts.type !== void 0 ? { type: opts.type } : void 0);
   } catch {
     throw new Error(`Cannot read file for upload: ${path}`);
   }
@@ -57908,23 +58078,27 @@ var pageSchema = {
   page_size: external_exports.number().int().min(1).max(200).default(50).describe("Number of items per page (1-200).")
 };
 function toolAnnotations(opts = {}) {
+  if (opts.readOnly === true && opts.destructive === true) {
+    throw new Error("toolAnnotations: readOnly: true contradicts destructive: true \u2014 a destructive tool is not read-only.");
+  }
   return {
     ...opts.title !== void 0 ? { title: opts.title } : {},
-    readOnlyHint: opts.readOnly ?? true,
+    readOnlyHint: opts.readOnly ?? opts.destructive === void 0,
     ...opts.idempotent !== void 0 ? { idempotentHint: opts.idempotent } : {},
+    ...opts.destructive !== void 0 ? { destructiveHint: opts.destructive } : {},
     ...opts.openWorld !== void 0 ? { openWorldHint: opts.openWorld } : {}
   };
 }
 
 // src/version.ts
-var VERSION = "2.1.0";
+var VERSION = "2.1.2";
 
 // src/client.ts
-import { dirname, join } from "path";
+import { dirname as dirname2, join as join2 } from "path";
 import { fileURLToPath } from "url";
 if (import.meta.url) {
-  const __dirname = dirname(fileURLToPath(import.meta.url));
-  await loadDotenvSafely({ path: join(__dirname, "..", ".env"), override: false });
+  const __dirname = dirname2(fileURLToPath(import.meta.url));
+  await loadDotenvSafely({ path: join2(__dirname, "..", ".env"), override: false });
 }
 var BASE_URL = "https://api.untappd.com/v4";
 var SERVICE = "Untappd";
@@ -59486,7 +59660,11 @@ function registerFriendActionTools(server, client2) {
       {
         title: action.title,
         description: `${action.detail} Acts on YOUR account and affects a real relationship with another person. Without confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it performs the action. Note: this endpoint path is taken from the Untappd app but is not otherwise independently verified.`,
-        annotations: toolAnnotations({ title: action.title, readOnly: false, idempotent: true, openWorld: true }),
+        // All four reach ANOTHER PERSON — the description says so itself: "affects
+        // a real relationship with another person". A friend request cannot be
+        // un-sent, and a rejection cannot be un-rejected, so none of them has an
+        // inverse in this tool set.
+        annotations: toolAnnotations({ title: action.title, readOnly: false, idempotent: true, openWorld: true, destructive: true }),
         inputSchema: external_exports.object({
           target_uid: TargetUidSchema,
           confirm: schemaConfirm
@@ -59516,7 +59694,7 @@ function registerWishlistTools(server, client2) {
     {
       title: "Add a beer to your wishlist",
       description: "Add a beer to YOUR Untappd wishlist by its bid. Without confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it adds. Writes to your account.",
-      annotations: toolAnnotations({ title: "Add a beer to your wishlist", readOnly: false, idempotent: true, openWorld: true }),
+      annotations: toolAnnotations({ title: "Add a beer to your wishlist", readOnly: false, idempotent: true, openWorld: true, destructive: false }),
       inputSchema: external_exports.object({
         bid: BidSchema2,
         confirm: schemaConfirm
@@ -59540,7 +59718,7 @@ function registerWishlistTools(server, client2) {
     {
       title: "Remove a beer from your wishlist",
       description: "Remove a beer from YOUR Untappd wishlist by its bid. Without confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it removes. Writes to your account.",
-      annotations: toolAnnotations({ title: "Remove a beer from your wishlist", readOnly: false, idempotent: true, openWorld: true }),
+      annotations: toolAnnotations({ title: "Remove a beer from your wishlist", readOnly: false, idempotent: true, openWorld: true, destructive: false }),
       inputSchema: external_exports.object({
         bid: BidSchema2,
         confirm: schemaConfirm
@@ -59562,7 +59740,7 @@ function registerWishlistTools(server, client2) {
 }
 
 // src/tools/checkin.ts
-import { existsSync } from "node:fs";
+import { existsSync as existsSync2 } from "node:fs";
 import { extname } from "node:path";
 var CheckinIdSchema = external_exports.number().int().positive().describe("Untappd check-in id");
 var PHOTO_CONTENT_TYPES = { jpg: "image/jpeg", png: "image/png" };
@@ -59582,7 +59760,7 @@ function registerCheckinTools(server, client2) {
     {
       title: "Toast an Untappd check-in",
       description: "Toast (like) a check-in on YOUR account. This endpoint is a TOGGLE: calling it on a check-in you have already toasted removes the toast. Without confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it posts. Writes to your Untappd account and is visible to others.",
-      annotations: toolAnnotations({ title: "Toast an Untappd check-in", readOnly: false, idempotent: false, openWorld: true }),
+      annotations: toolAnnotations({ title: "Toast an Untappd check-in", readOnly: false, idempotent: false, openWorld: true, destructive: false }),
       inputSchema: external_exports.object({
         checkin_id: CheckinIdSchema,
         confirm: schemaConfirm
@@ -59606,7 +59784,7 @@ function registerCheckinTools(server, client2) {
     {
       title: "Comment on an Untappd check-in",
       description: "Post a comment on a check-in from YOUR account. Without confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it posts. Writes to your Untappd account and is visible to others.",
-      annotations: toolAnnotations({ title: "Comment on an Untappd check-in", readOnly: false, idempotent: false, openWorld: true }),
+      annotations: toolAnnotations({ title: "Comment on an Untappd check-in", readOnly: false, idempotent: false, openWorld: true, destructive: false }),
       inputSchema: external_exports.object({
         checkin_id: CheckinIdSchema,
         comment: external_exports.string().min(1).max(2e3).describe("Comment text to post"),
@@ -59632,7 +59810,7 @@ function registerCheckinTools(server, client2) {
     {
       title: "Delete a comment from an Untappd check-in",
       description: "Delete one of YOUR comments by its comment id (the id from a check-in's comments list). Without confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it deletes.",
-      annotations: toolAnnotations({ title: "Delete a comment from an Untappd check-in", readOnly: false, idempotent: true, openWorld: true }),
+      annotations: toolAnnotations({ title: "Delete a comment from an Untappd check-in", readOnly: false, idempotent: true, openWorld: true, destructive: true }),
       inputSchema: external_exports.object({
         comment_id: external_exports.number().int().positive().describe("Untappd comment id (from a check-in's comments.items)"),
         confirm: schemaConfirm
@@ -59656,7 +59834,7 @@ function registerCheckinTools(server, client2) {
     {
       title: "Delete an Untappd check-in",
       description: "Permanently delete one of YOUR check-ins by its id. This is destructive and cannot be undone. Without confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it deletes.",
-      annotations: toolAnnotations({ title: "Delete an Untappd check-in", readOnly: false, idempotent: true, openWorld: true }),
+      annotations: toolAnnotations({ title: "Delete an Untappd check-in", readOnly: false, idempotent: true, openWorld: true, destructive: true }),
       inputSchema: external_exports.object({
         checkin_id: CheckinIdSchema,
         confirm: schemaConfirm
@@ -59680,7 +59858,7 @@ function registerCheckinTools(server, client2) {
     {
       title: "Check in a beer on Untappd",
       description: "Post a NEW beer check-in to YOUR Untappd account \u2014 this publishes to your public feed. Provide the beer id (bid) from untappd_search_beer; optionally a rating (0\u20135 in 0.25 steps), a shout (comment), a venue via foursquare_id, and a local photo via photo_path (JPEG/PNG). Without confirm: true it returns a dry-run preview of the exact fields and makes NO network call; with confirm: true it posts.",
-      annotations: toolAnnotations({ title: "Check in a beer on Untappd", readOnly: false, idempotent: false, openWorld: true }),
+      annotations: toolAnnotations({ title: "Check in a beer on Untappd", readOnly: false, idempotent: false, openWorld: true, destructive: false }),
       inputSchema: external_exports.object({
         bid: external_exports.number().int().positive().describe("Untappd beer id to check in (from untappd_search_beer)"),
         rating: RatingSchema.optional().describe("Rating 0\u20135 in 0.25 increments (omit for no rating)"),
@@ -59729,7 +59907,7 @@ function registerCheckinTools(server, client2) {
       }
       let blob;
       if (photo_path !== void 0) {
-        if (!existsSync(photo_path)) throw new McpToolError(`Photo file not found: ${photo_path}`);
+        if (!existsSync2(photo_path)) throw new McpToolError(`Photo file not found: ${photo_path}`);
         blob = await fileBlob(photo_path);
       }
       const data = await client2.write("POST", "/checkin/add", { form });
@@ -60194,7 +60372,7 @@ function registerCacheTools(server, client2, cacheProvider) {
     {
       title: "Sync a user's check-ins into the cache",
       description: "Fetch a user's detailed check-ins (venue, date, comment) into the cache from user/checkins. Incremental and resumable: pages backwards up to max_pages per call, persisting progress every page; run again until another_run_needed is false. NOTE: Untappd only returns the ~50 most recent check-ins for accounts other than your own and will not page further \u2014 such a sync reports history_truncated and you should use untappd_sync_user_beers for full has-had coverage. backfill_complete is only reported once ~all of total_checkins is cached. Pass force_backfill: true to reset a cache wrongly marked complete and re-page the whole history (cached rows are kept). Omit username for your own account.",
-      annotations: toolAnnotations({ title: "Sync a user's check-ins into the cache", readOnly: false, idempotent: false, openWorld: true }),
+      annotations: toolAnnotations({ title: "Sync a user's check-ins into the cache", readOnly: false, idempotent: false, openWorld: true, destructive: false }),
       inputSchema: external_exports.object({
         username: UsernameArg2,
         max_pages: external_exports.number().int().min(1).max(50).optional().describe("Pages (50 check-ins each) to fetch this run (default 10). Keep modest to respect the ~100 calls/hour rate limit."),
@@ -60215,7 +60393,7 @@ function registerCacheTools(server, client2, cacheProvider) {
     {
       title: "Sync a user's complete distinct-beers list into the cache",
       description: `Fetch a user's COMPLETE distinct-beers list (every unique beer they've ever had, with their rating, times-had count, and first/last dates) into the cache from user/beers. This is the cheapest way to get full "has had" coverage \u2014 thousands of beers instead of tens of thousands of check-ins \u2014 and, unlike user/checkins, it pages fully for any public/friend account. Offset-paged and resumable: fetches max_pages per call and persists progress; run again until another_run_needed is false. Feeds the same untappd_cache_has_had / has_had_many / not_had tools. Omit username for your own account.`,
-      annotations: toolAnnotations({ title: "Sync a user's complete distinct-beers list into the cache", readOnly: false, idempotent: false, openWorld: true }),
+      annotations: toolAnnotations({ title: "Sync a user's complete distinct-beers list into the cache", readOnly: false, idempotent: false, openWorld: true, destructive: false }),
       inputSchema: external_exports.object({
         username: UsernameArg2,
         max_pages: external_exports.number().int().min(1).max(50).optional().describe("Pages (50 beers each) to fetch this run (default 10). Keep modest to respect the ~100 calls/hour rate limit.")
@@ -60349,7 +60527,7 @@ function registerCacheTools(server, client2, cacheProvider) {
     {
       title: "Top-rated beers a user has NOT had, from a candidate list",
       description: 'The "what should I order off this tap list?" tool. From a list of candidate beer ids, return the top N the user has NOT yet had, ranked by Untappd global rating, with an optional style filter. Not-had filtering uses the cache only (both sources, no API call). Beer ratings/styles come from a metadata cache; a beer/info API call is made only on a cache miss or if the cached metadata is >30 days old, capped at api_budget calls per run (~100 calls/hour limit) \u2014 if more are needed it returns partial: true / another_run_needed: true, so re-running fills the rest. Reports the same freshness/caveat block as untappd_cache_not_had. Omit username for your own account.',
-      annotations: toolAnnotations({ title: "Top-rated beers a user has NOT had, from a candidate list", readOnly: false, idempotent: false, openWorld: true }),
+      annotations: toolAnnotations({ title: "Top-rated beers a user has NOT had, from a candidate list", readOnly: false, idempotent: false, openWorld: true, destructive: false }),
       inputSchema: external_exports.object({
         username: UsernameArg2,
         bids: external_exports.array(external_exports.number().int().positive()).min(1).max(100).describe("Candidate beer ids (1\u2013100)"),
@@ -60443,8 +60621,8 @@ function registerCacheTools(server, client2, cacheProvider) {
 // src/cache/db.ts
 import { DatabaseSync } from "node:sqlite";
 import { mkdirSync } from "node:fs";
-import { dirname as dirname2, join as join2 } from "node:path";
-import { homedir } from "node:os";
+import { dirname as dirname3, join as join3 } from "node:path";
+import { homedir as homedir2 } from "node:os";
 var NodeSqlDriver = class {
   constructor(db) {
     this.db = db;
@@ -60481,7 +60659,7 @@ var CheckinCache = class _CheckinCache extends LocalCacheStore {
   db;
   /** Open (creating parent dirs) a file-backed cache, or `:memory:` for tests. */
   static open(path) {
-    if (path !== ":memory:") mkdirSync(dirname2(path), { recursive: true });
+    if (path !== ":memory:") mkdirSync(dirname3(path), { recursive: true });
     return new _CheckinCache(new DatabaseSync(path));
   }
   close() {
@@ -60489,7 +60667,7 @@ var CheckinCache = class _CheckinCache extends LocalCacheStore {
   }
 };
 function defaultCachePath() {
-  return readEnvVar("UNTAPPD_CACHE_DB") ?? join2(homedir(), ".untappd-mcp", "checkins.db");
+  return readEnvVar("UNTAPPD_CACHE_DB") ?? join3(homedir2(), ".untappd-mcp", "checkins.db");
 }
 
 // src/index.ts

package/dist/tools/cache.js

@@ -92,7 +92,7 @@ export function registerCacheTools(server, client, cacheProvider) {
             'untappd_sync_user_beers for full has-had coverage. backfill_complete is only reported once ~all of ' +
             'total_checkins is cached. Pass force_backfill: true to reset a cache wrongly marked complete and re-page ' +
             'the whole history (cached rows are kept). Omit username for your own account.',
-        annotations: toolAnnotations({ title: "Sync a user's check-ins into the cache", readOnly: false, idempotent: false, openWorld: true }),
+        annotations: toolAnnotations({ title: "Sync a user's check-ins into the cache", readOnly: false, idempotent: false, openWorld: true, destructive: false }),
         inputSchema: z.object({
             username: UsernameArg,
             max_pages: z
@@ -123,7 +123,7 @@ export function registerCacheTools(server, client, cacheProvider) {
             'user/checkins, it pages fully for any public/friend account. Offset-paged and resumable: fetches max_pages ' +
             'per call and persists progress; run again until another_run_needed is false. Feeds the same ' +
             'untappd_cache_has_had / has_had_many / not_had tools. Omit username for your own account.',
-        annotations: toolAnnotations({ title: "Sync a user's complete distinct-beers list into the cache", readOnly: false, idempotent: false, openWorld: true }),
+        annotations: toolAnnotations({ title: "Sync a user's complete distinct-beers list into the cache", readOnly: false, idempotent: false, openWorld: true, destructive: false }),
         inputSchema: z.object({
             username: UsernameArg,
             max_pages: z
@@ -271,7 +271,7 @@ export function registerCacheTools(server, client, cacheProvider) {
             'run (~100 calls/hour limit) — if more are needed it returns partial: true / another_run_needed: true, so ' +
             're-running fills the rest. Reports the same freshness/caveat block as untappd_cache_not_had. Omit username ' +
             'for your own account.',
-        annotations: toolAnnotations({ title: 'Top-rated beers a user has NOT had, from a candidate list', readOnly: false, idempotent: false, openWorld: true }),
+        annotations: toolAnnotations({ title: 'Top-rated beers a user has NOT had, from a candidate list', readOnly: false, idempotent: false, openWorld: true, destructive: false }),
         inputSchema: z.object({
             username: UsernameArg,
             bids: z.array(z.number().int().positive()).min(1).max(100).describe('Candidate beer ids (1–100)'),

package/dist/tools/checkin.js

@@ -28,7 +28,7 @@ export function registerCheckinTools(server, client) {
         description: "Toast (like) a check-in on YOUR account. This endpoint is a TOGGLE: calling it on a check-in you have " +
             'already toasted removes the toast. Without confirm: true it returns a dry-run preview and makes NO network ' +
             'call; with confirm: true it posts. Writes to your Untappd account and is visible to others.',
-        annotations: toolAnnotations({ title: 'Toast an Untappd check-in', readOnly: false, idempotent: false, openWorld: true }),
+        annotations: toolAnnotations({ title: 'Toast an Untappd check-in', readOnly: false, idempotent: false, openWorld: true, destructive: false }),
         inputSchema: z.object({
             checkin_id: CheckinIdSchema,
             confirm: schemaConfirm,
@@ -49,7 +49,7 @@ export function registerCheckinTools(server, client) {
         title: 'Comment on an Untappd check-in',
         description: 'Post a comment on a check-in from YOUR account. Without confirm: true it returns a dry-run preview and ' +
             'makes NO network call; with confirm: true it posts. Writes to your Untappd account and is visible to others.',
-        annotations: toolAnnotations({ title: 'Comment on an Untappd check-in', readOnly: false, idempotent: false, openWorld: true }),
+        annotations: toolAnnotations({ title: 'Comment on an Untappd check-in', readOnly: false, idempotent: false, openWorld: true, destructive: false }),
         inputSchema: z.object({
             checkin_id: CheckinIdSchema,
             comment: z.string().min(1).max(2000).describe('Comment text to post'),
@@ -72,7 +72,7 @@ export function registerCheckinTools(server, client) {
         title: 'Delete a comment from an Untappd check-in',
         description: 'Delete one of YOUR comments by its comment id (the id from a check-in\'s comments list). Without ' +
             'confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it deletes.',
-        annotations: toolAnnotations({ title: 'Delete a comment from an Untappd check-in', readOnly: false, idempotent: true, openWorld: true }),
+        annotations: toolAnnotations({ title: 'Delete a comment from an Untappd check-in', readOnly: false, idempotent: true, openWorld: true, destructive: true }),
         inputSchema: z.object({
             comment_id: z.number().int().positive().describe('Untappd comment id (from a check-in\'s comments.items)'),
             confirm: schemaConfirm,
@@ -93,7 +93,7 @@ export function registerCheckinTools(server, client) {
         title: 'Delete an Untappd check-in',
         description: 'Permanently delete one of YOUR check-ins by its id. This is destructive and cannot be undone. Without ' +
             'confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it deletes.',
-        annotations: toolAnnotations({ title: 'Delete an Untappd check-in', readOnly: false, idempotent: true, openWorld: true }),
+        annotations: toolAnnotations({ title: 'Delete an Untappd check-in', readOnly: false, idempotent: true, openWorld: true, destructive: true }),
         inputSchema: z.object({
             checkin_id: CheckinIdSchema,
             confirm: schemaConfirm,
@@ -116,7 +116,7 @@ export function registerCheckinTools(server, client) {
             '(bid) from untappd_search_beer; optionally a rating (0–5 in 0.25 steps), a shout (comment), a venue via ' +
             'foursquare_id, and a local photo via photo_path (JPEG/PNG). Without confirm: true it returns a dry-run ' +
             'preview of the exact fields and makes NO network call; with confirm: true it posts.',
-        annotations: toolAnnotations({ title: 'Check in a beer on Untappd', readOnly: false, idempotent: false, openWorld: true }),
+        annotations: toolAnnotations({ title: 'Check in a beer on Untappd', readOnly: false, idempotent: false, openWorld: true, destructive: false }),
         inputSchema: z.object({
             bid: z.number().int().positive().describe('Untappd beer id to check in (from untappd_search_beer)'),
             rating: RatingSchema.optional().describe('Rating 0–5 in 0.25 increments (omit for no rating)'),

package/dist/tools/friends.js

@@ -50,7 +50,11 @@ export function registerFriendActionTools(server, client) {
                 'Without confirm: true it returns a dry-run preview and makes NO network call; with confirm: true it ' +
                 'performs the action. Note: this endpoint path is taken from the Untappd app but is not otherwise ' +
                 'independently verified.',
-            annotations: toolAnnotations({ title: action.title, readOnly: false, idempotent: true, openWorld: true }),
+            // All four reach ANOTHER PERSON — the description says so itself: "affects
+            // a real relationship with another person". A friend request cannot be
+            // un-sent, and a rejection cannot be un-rejected, so none of them has an
+            // inverse in this tool set.
+            annotations: toolAnnotations({ title: action.title, readOnly: false, idempotent: true, openWorld: true, destructive: true }),
             inputSchema: z.object({
                 target_uid: TargetUidSchema,
                 confirm: schemaConfirm,

package/dist/tools/wishlist.js

@@ -6,7 +6,7 @@ export function registerWishlistTools(server, client) {
         title: 'Add a beer to your wishlist',
         description: 'Add a beer to YOUR Untappd wishlist by its bid. Without confirm: true it returns a dry-run preview and ' +
             'makes NO network call; with confirm: true it adds. Writes to your account.',
-        annotations: toolAnnotations({ title: 'Add a beer to your wishlist', readOnly: false, idempotent: true, openWorld: true }),
+        annotations: toolAnnotations({ title: 'Add a beer to your wishlist', readOnly: false, idempotent: true, openWorld: true, destructive: false }),
         inputSchema: z.object({
             bid: BidSchema,
             confirm: schemaConfirm,
@@ -27,7 +27,7 @@ export function registerWishlistTools(server, client) {
         title: 'Remove a beer from your wishlist',
         description: 'Remove a beer from YOUR Untappd wishlist by its bid. Without confirm: true it returns a dry-run preview ' +
             'and makes NO network call; with confirm: true it removes. Writes to your account.',
-        annotations: toolAnnotations({ title: 'Remove a beer from your wishlist', readOnly: false, idempotent: true, openWorld: true }),
+        annotations: toolAnnotations({ title: 'Remove a beer from your wishlist', readOnly: false, idempotent: true, openWorld: true, destructive: false }),
         inputSchema: z.object({
             bid: BidSchema,
             confirm: schemaConfirm,

package/dist/version.js

@@ -3,4 +3,4 @@
 // json's `extra-files`), and `versionSyncTest` guards that it stays equal to
 // package.json. Import VERSION wherever the version is needed rather than
 // re-declaring it.
-export const VERSION = '2.1.0'; // x-release-please-version
+export const VERSION = '2.1.2'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "untappd-mcp",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "mcpName": "io.github.chrischall/untappd-mcp",
   "description": "Untappd MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -45,11 +45,11 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^1.0.0",
+    "@chrischall/mcp-utils": "^2.4.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "ai": "^7.0.19",
-    "dotenv": "^17.4.0",
-    "zod": "^4.6.2"
+    "dotenv": "^18.0.1",
+    "zod": "^4.6.5"
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "^2.0.0",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/untappd-mcp",
     "source": "github"
   },
-  "version": "2.1.0",
+  "version": "2.1.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "untappd-mcp",
-      "version": "2.1.0",
+      "version": "2.1.2",
       "transport": {
         "type": "stdio"
       },