untappd-mcp 2.1.2 → 2.2.0

package/dist/tools/wishlist.js

@@ -1,46 +1,53 @@
 import { z } from 'zod';
-import { minifiedResult, schemaConfirm, toolAnnotations } from '@chrischall/mcp-utils';
+import { confirmTokenParam, minifiedResult, toolAnnotations } from '@chrischall/mcp-utils';
+import { CONFIRM_FLOW, confirmWrite } from './confirm.js';
 const BidSchema = z.number().int().positive().describe('Untappd beer id (bid) — from untappd_search_beer');
 export function registerWishlistTools(server, client) {
     server.registerTool('untappd_wishlist_add', {
         title: 'Add a beer to your wishlist',
-        description: 'Add a beer to YOUR Untappd wishlist by its bid. Without confirm: true it returns a dry-run preview and ' +
-            'makes NO network call; with confirm: true it adds. Writes to your account.',
+        description: `Add a beer to YOUR Untappd wishlist by its bid. Writes to your account. ${CONFIRM_FLOW}`,
         annotations: toolAnnotations({ title: 'Add a beer to your wishlist', readOnly: false, idempotent: true, openWorld: true, destructive: false }),
         inputSchema: z.object({
             bid: BidSchema,
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
-    }, async ({ bid, confirm }) => {
-        if (confirm !== true) {
-            return minifiedResult({
-                dryRun: true,
-                action: 'wishlist_add',
-                bid,
-                note: 'Dry run — re-run with confirm: true to add this beer to your wishlist.',
-            });
-        }
+    }, async ({ bid, confirmToken }, ctx) => {
+        const request = { method: 'GET', path: '/user/wishlist/add', query: { bid } };
+        const gate = await confirmWrite(ctx, {
+            tool: 'untappd_wishlist_add',
+            action: 'untappd.wishlist_add',
+            message: 'Review and confirm adding this beer to your Untappd wishlist:',
+            confirmToken,
+            target: bid,
+            payload: request,
+            preview: { action: 'wishlist_add', bid, ...request, note: 'Adds this beer to your Untappd wishlist.' },
+        });
+        if (gate)
+            return gate;
         const data = await client.write('GET', '/user/wishlist/add', { query: { bid } });
         return minifiedResult({ added: true, bid, result: data?.result });
     });
     server.registerTool('untappd_wishlist_remove', {
         title: 'Remove a beer from your wishlist',
-        description: 'Remove a beer from YOUR Untappd wishlist by its bid. Without confirm: true it returns a dry-run preview ' +
-            'and makes NO network call; with confirm: true it removes. Writes to your account.',
+        description: `Remove a beer from YOUR Untappd wishlist by its bid. Writes to your account. ${CONFIRM_FLOW}`,
         annotations: toolAnnotations({ title: 'Remove a beer from your wishlist', readOnly: false, idempotent: true, openWorld: true, destructive: false }),
         inputSchema: z.object({
             bid: BidSchema,
-            confirm: schemaConfirm,
+            confirmToken: confirmTokenParam,
         }),
-    }, async ({ bid, confirm }) => {
-        if (confirm !== true) {
-            return minifiedResult({
-                dryRun: true,
-                action: 'wishlist_remove',
-                bid,
-                note: 'Dry run — re-run with confirm: true to remove this beer from your wishlist.',
-            });
-        }
+    }, async ({ bid, confirmToken }, ctx) => {
+        const request = { method: 'GET', path: '/user/wishlist/delete', query: { bid } };
+        const gate = await confirmWrite(ctx, {
+            tool: 'untappd_wishlist_remove',
+            action: 'untappd.wishlist_remove',
+            message: 'Review and confirm removing this beer from your Untappd wishlist:',
+            confirmToken,
+            target: bid,
+            payload: request,
+            preview: { action: 'wishlist_remove', bid, ...request, note: 'Removes this beer from your Untappd wishlist.' },
+        });
+        if (gate)
+            return gate;
         const data = await client.write('GET', '/user/wishlist/delete', { query: { bid } });
         return minifiedResult({ removed: true, bid, result: data?.result });
     });

package/dist/version.js

@@ -3,4 +3,4 @@
 // json's `extra-files`), and `versionSyncTest` guards that it stays equal to
 // package.json. Import VERSION wherever the version is needed rather than
 // re-declaring it.
-export const VERSION = '2.1.2'; // x-release-please-version
+export const VERSION = '2.2.0'; // x-release-please-version

package/mint.yaml

@@ -26,6 +26,15 @@ env:
     required: true
     help: >-
       Untappd mobile app client secret.
+  - name: UNTAPPD_TIMEZONE
+    required: false
+    help: >-
+      IANA timezone (e.g. America/New_York) that check-ins are stamped with
+      when a call passes no timezone. Defaults to the server's own zone.
+  - name: UNTAPPD_PHOTO_DIR
+    required: false
+    help: >-
+      Restrict check-in photo uploads to files inside this directory.
   - name: UNTAPPD_CACHE_DB
     required: false
     help: >-

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "untappd-mcp",
-  "version": "2.1.2",
+  "version": "2.2.0",
   "mcpName": "io.github.chrischall/untappd-mcp",
   "description": "Untappd MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -45,7 +45,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^2.4.0",
+    "@chrischall/mcp-utils": "^2.6.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "ai": "^7.0.19",
     "dotenv": "^18.0.1",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/untappd-mcp",
     "source": "github"
   },
-  "version": "2.1.2",
+  "version": "2.2.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "untappd-mcp",
-      "version": "2.1.2",
+      "version": "2.2.0",
       "transport": {
         "type": "stdio"
       },

package/skills/untappd-mcp/SKILL.md

@@ -109,9 +109,9 @@ one that exists.
 Each for its own reason — and none of them will tell you it ignored the
 parameter, because an undeclared key is dropped by zod without a warning:
 
-- **The 11 confirm-gated writes** (`untappd_checkin`, `untappd_toast`,
+- **The 11 confirmation-gated writes** (`untappd_checkin`, `untappd_toast`,
   `untappd_add_comment`, the two deletes, the wishlist pair, the four friend
-  actions) answer with a dry-run preview or a receipt. Nothing in a receipt is
+  actions) answer with a confirmation preview or a receipt. Nothing in a receipt is
   decoration.
 - **`untappd_sync_checkins` / `untappd_sync_user_beers`** answer with sync
   PROGRESS — pages walked, `another_run_needed`, `backfill_complete`. Slimming
@@ -140,10 +140,15 @@ parameter, because an undeclared key is dropped by zod without a warning:
   (#161) — it takes a `view` now, and its field shape is documented with the
   other projections above.
 
-## Write tools (confirm-gated — these post to your public account)
+## Write tools (confirmation-gated — these post to your public account)
 
-Each returns a dry-run preview and makes NO network call unless called with
-`confirm: true`:
+Each asks the user to confirm first. Where the client can show a confirmation
+prompt, it does. Otherwise the first call makes NO network call and returns
+`status: "confirmation-required"` with a `preview` of the exact request and a
+`confirmToken`; show the preview to the user, and only after they approve call
+the tool again with the same arguments plus `confirmToken`. A token works once
+and only for those arguments (a change returns `DRAFT_CHANGED` with a fresh
+preview). `MCP_CONFIRM_MODE` on the server can make this `auto` or `refuse`.
 
 - `untappd_toast` — toast/like a check-in (this endpoint is a toggle).
 - `untappd_add_comment` — comment on a check-in.