untappd-mcp 2.1.3 → 2.2.1

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Untappd — beers, breweries, venues, check-ins, wishlists, and your friend feed",
-    "version": "2.1.3"
+    "version": "2.2.1"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Untappd",
       "source": "./",
       "description": "MCP server for Untappd — search beers/breweries/venues, read profiles/check-ins/wishlists, and post check-ins, toasts, and comments",
-      "version": "2.1.3",
+      "version": "2.2.1",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "untappd-mcp",
   "displayName": "Untappd",
-  "version": "2.1.3",
+  "version": "2.2.1",
   "description": "MCP server for Untappd — search beers/breweries/venues, read check-ins and wishlists, and post check-ins, toasts, and comments",
   "author": {
     "name": "Chris Hall",

package/README.md

@@ -36,10 +36,25 @@ it goes stale.
 | `UNTAPPD_USER_AGENT` | no | Override the User-Agent (default mimics the app). |
 | `UNTAPPD_TIMEZONE` | no | IANA timezone (e.g. `America/New_York`) that check-ins are stamped with when the call doesn't pass `timezone`. Set it when the server runs somewhere other than the drinker's zone (e.g. a hosted connector, usually UTC). Defaults to the server process's zone. |
 | `UNTAPPD_PHOTO_DIR` | no | Restrict `untappd_checkin`'s `photo_path` to files inside this directory (several allowed, separated by `:`). Recommended wherever the model can be steered by untrusted content. |
-| `UNTAPPD_CACHE_DB` | no | Path to the local check-in cache SQLite file (default `~/.untappd-mcp/checkins.db`). Local/stdio only. |
+| `UNTAPPD_CACHE_DB` | no | Path to the local check-in cache SQLite file (default `~/.untappd-mcp/checkins.db`; created owner-only — dir `0700`, file `0600`). Local/stdio only. |
 
 Copy `.env.example` to `.env` and fill it in for local use.
 
+### Confirmations
+
+Every write asks you to confirm it first. A client that can show a confirmation
+prompt (Claude Code) shows one. Elsewhere the write takes two calls: the first
+does nothing and returns a preview of the exact request plus a `confirmToken`,
+and only a repeat call with the same arguments and that token performs it. A
+token works once, for that tool and those arguments only; change anything and
+the call is refused with a fresh preview.
+
+| variable | default | |
+|---|---|---|
+| `MCP_CONFIRM_MODE` | `ask-user` | What a write does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call does nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: writes are refused on such clients. A client that can show prompts (Claude Code) always gets the real prompt. An unrecognised value is treated as `refuse`. |
+| `MCP_CONFIRM_TTL_SECONDS` | `600` | How long a token stays valid. |
+| `MCP_CONFIRM_SECRET` | random per process | Signing key; set it only if tokens must survive a server restart. |
+
 ### Obtaining the client id / secret
 
 Untappd does not publish these; they live in the mobile app. Capture them from
@@ -65,14 +80,13 @@ Reads: `untappd_search_beer`, `untappd_beer_info`, `untappd_beer_activity`,
 `untappd_activity_feed`, `untappd_checkin_info`, `untappd_resolve`, `untappd_open_url`, `untappd_user_venues`, `untappd_venue_by_foursquare`, `untappd_trending`,
 `untappd_notifications`, `untappd_local_checkins`, `untappd_healthcheck`.
 
-Writes (confirm-gated — return a dry-run preview unless called with
-`confirm: true`): `untappd_toast`, `untappd_add_comment`, `untappd_delete_comment`, `untappd_checkin`,
+Writes (each asks you to confirm first — see [Confirmations](#confirmations)): `untappd_toast`, `untappd_add_comment`, `untappd_delete_comment`, `untappd_checkin`,
 `untappd_wishlist_add`, `untappd_wishlist_remove`, `untappd_delete_checkin`,
 `untappd_add_friend`, `untappd_accept_friend`, `untappd_reject_friend`, `untappd_remove_friend`.
 
 Check-in cache: `untappd_sync_checkins`, `untappd_sync_user_beers`,
 `untappd_cache_has_had`, `untappd_cache_has_had_many`, `untappd_cache_not_had`,
-`untappd_cache_query`, `untappd_top_not_had`.
+`untappd_cache_query`, `untappd_top_not_had`, `untappd_cache_forget`.
 
 ## Check-in cache
 
@@ -135,6 +149,15 @@ Syncing **another** user goes through the same authed endpoint as
 account is public or your friend. Otherwise the sync returns a clear error
 telling you to add them as a friend first.
 
+**Retention.** Nothing in the cache expires: synced rows — including another
+user's dated check-ins, comments and venues — stay until you remove them. The
+file is created owner-only (directory `0700`, database `0600`, and older
+installs are tightened on open). `untappd_cache_forget` deletes one user's
+cached check-ins, distinct-beers list and sync state after a confirmation
+(preview shows the username and row counts); it touches only the local cache,
+never Untappd, and a later sync can re-fetch. Deleting the file removes
+everything.
+
 A cache holds only the check-ins the account it belongs to was allowed to
 fetch. `untappd_healthcheck` reports the running version and the exact tool set
 (count + names + a stable hash), so you can confirm which build is serving.