untappd-mcp 2.3.0 → 2.3.2

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Untappd — beers, breweries, venues, check-ins, wishlists, and your friend feed",
-    "version": "2.3.0"
+    "version": "2.3.2"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Untappd",
       "source": "./",
       "description": "MCP server for Untappd — search beers/breweries/venues, read profiles/check-ins/wishlists, and post check-ins, toasts, and comments",
-      "version": "2.3.0",
+      "version": "2.3.2",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "untappd-mcp",
   "displayName": "Untappd",
-  "version": "2.3.0",
+  "version": "2.3.2",
   "description": "MCP server for Untappd — search beers/breweries/venues, read check-ins and wishlists, and post check-ins, toasts, and comments",
   "author": {
     "name": "Chris Hall",
@@ -18,5 +18,5 @@
     "mcp"
   ],
   "skills": "./skills/",
-  "mcp": "./.mcp.json"
+  "mcpServers": "./.mcp.json"
 }

package/.mcp.json

@@ -1,9 +1,10 @@
 {
   "mcpServers": {
     "untappd": {
-      "command": "node",
-      "args": ["${CLAUDE_PLUGIN_ROOT}/dist/index.js"],
+      "command": "npx",
+      "args": ["-y", "untappd-mcp"],
       "env": {
+        "UNTAPPD_ACCESS_TOKEN": "${UNTAPPD_ACCESS_TOKEN}",
         "UNTAPPD_USERNAME": "${UNTAPPD_USERNAME}",
         "UNTAPPD_PASSWORD": "${UNTAPPD_PASSWORD}",
         "UNTAPPD_CLIENT_ID": "${UNTAPPD_CLIENT_ID}",

package/README.md

@@ -13,9 +13,10 @@ activity feed; and post check-ins, toasts, and comments.
 
 Untappd's iPad/iPhone app authenticates with a username/password **xauth** login
 (`POST https://api.untappd.com/v4/xauth`) that returns an access token, then
-calls the v4 API. This server reproduces that exactly:
+calls the v4 API. This server reproduces that, except where the token goes:
 
-- Reads carry the token as an `access_token` query param.
+- Reads carry the token as an `Authorization: Bearer` header, never in the URL
+  (the app uses an `access_token` query param; the API accepts both).
 - Writes carry it as an `Authorization: Bearer` header (with the app's client
   credentials in the query), matching the app's real requests.
 
@@ -29,14 +30,14 @@ it goes stale.
 | `UNTAPPD_ACCESS_TOKEN` | no | An access token you already hold. Supply this and **no password is needed** — the xauth login is skipped entirely. |
 | `UNTAPPD_USERNAME` | if no token | Your Untappd username or login email. |
 | `UNTAPPD_PASSWORD` | if no token | Your Untappd password (used only for the xauth login that mints a token). |
-| `UNTAPPD_CLIENT_ID` | yes | The Untappd mobile app client id (see below). |
-| `UNTAPPD_CLIENT_SECRET` | yes | The Untappd mobile app client secret. |
+| `UNTAPPD_CLIENT_ID` | for login & writes | The Untappd mobile app client id (see below). A pre-seeded access token can read without it. |
+| `UNTAPPD_CLIENT_SECRET` | for login & writes | The Untappd mobile app client secret. |
 | `UNTAPPD_DEVICE_ID` | no | Stable device UUID the token is keyed to (a default is provided). |
 | `UNTAPPD_UTV` | no | API version param (default `4.0.0`). |
 | `UNTAPPD_USER_AGENT` | no | Override the User-Agent (default mimics the app). |
 | `UNTAPPD_TIMEZONE` | no | IANA timezone (e.g. `America/New_York`) that check-ins are stamped with when the call doesn't pass `timezone`. Set it when the server runs somewhere other than the drinker's zone (e.g. a hosted connector, usually UTC). Defaults to the server process's zone. |
-| `UNTAPPD_PHOTO_DIR` | no | Restrict `untappd_checkin`'s `photo_path` to files inside this directory (several allowed, separated by `:`). Recommended wherever the model can be steered by untrusted content. |
-| `UNTAPPD_CACHE_DB` | no | Path to the local check-in cache SQLite file (default `~/.untappd-mcp/checkins.db`; created owner-only — dir `0700`, file `0600`). Local/stdio only. |
+| `UNTAPPD_PHOTO_DIR` | no | The directory `untappd_checkin`'s `photo_path` must be inside (several allowed, separated by `:`). Defaults to `~/Downloads/untappd-mcp` — put a photo there to attach it. Any other file is refused, so a prompt-injected shout or comment can't publish an arbitrary image from your disk. |
+| `UNTAPPD_CACHE_DB` | no | Path to the local check-in cache SQLite file (default `~/.untappd-mcp/checkins.db`). The db file is always made owner-only (`0600`), and so are any directories the server creates plus the default `~/.untappd-mcp`; a directory you point this into that already exists keeps its permissions. Local/stdio only. |
 
 Copy `.env.example` to `.env` and fill it in for local use.