untappd-mcp 2.3.0 → 2.3.2

package/dist/tools/wishlist.js

@@ -11,13 +11,15 @@ export function registerWishlistTools(server, client) {
             bid: BidSchema,
             confirmToken: confirmTokenParam,
         }),
-    }, async ({ bid, confirmToken }, ctx) => {
+    }, async (args, ctx) => {
+        const { bid, confirmToken } = args;
         const request = { method: 'GET', path: '/user/wishlist/add', query: { bid } };
         const gate = await confirmWrite(ctx, {
             tool: 'untappd_wishlist_add',
             action: 'untappd.wishlist_add',
             message: 'Review and confirm adding this beer to your Untappd wishlist:',
             confirmToken,
+            args,
             target: bid,
             payload: request,
             preview: { action: 'wishlist_add', bid, ...request, note: 'Adds this beer to your Untappd wishlist.' },
@@ -35,13 +37,15 @@ export function registerWishlistTools(server, client) {
             bid: BidSchema,
             confirmToken: confirmTokenParam,
         }),
-    }, async ({ bid, confirmToken }, ctx) => {
+    }, async (args, ctx) => {
+        const { bid, confirmToken } = args;
         const request = { method: 'GET', path: '/user/wishlist/delete', query: { bid } };
         const gate = await confirmWrite(ctx, {
             tool: 'untappd_wishlist_remove',
             action: 'untappd.wishlist_remove',
             message: 'Review and confirm removing this beer from your Untappd wishlist:',
             confirmToken,
+            args,
             target: bid,
             payload: request,
             preview: { action: 'wishlist_remove', bid, ...request, note: 'Removes this beer from your Untappd wishlist.' },

package/dist/version.js

@@ -3,4 +3,4 @@
 // json's `extra-files`), and `versionSyncTest` guards that it stays equal to
 // package.json. Import VERSION wherever the version is needed rather than
 // re-declaring it.
-export const VERSION = '2.3.0'; // x-release-please-version
+export const VERSION = '2.3.2'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "untappd-mcp",
-  "version": "2.3.0",
+  "version": "2.3.2",
   "mcpName": "io.github.chrischall/untappd-mcp",
   "description": "Untappd MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -45,9 +45,8 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^2.15.0",
+    "@chrischall/mcp-utils": "^3.0.3",
     "@modelcontextprotocol/server": "^2.3.0",
-    "ai": "^7.0.19",
     "dotenv": "^18.0.1",
     "zod": "^4.6.5"
   },

package/server.json

@@ -6,43 +6,92 @@
     "url": "https://github.com/chrischall/untappd-mcp",
     "source": "github"
   },
-  "version": "2.3.0",
+  "version": "2.3.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "untappd-mcp",
-      "version": "2.3.0",
+      "version": "2.3.2",
       "transport": {
         "type": "stdio"
       },
       "environmentVariables": [
+        {
+          "name": "UNTAPPD_ACCESS_TOKEN",
+          "description": "An Untappd access token you already hold. Supply it and no password is needed (username/password become optional).",
+          "isRequired": false,
+          "format": "string",
+          "isSecret": true
+        },
         {
           "name": "UNTAPPD_USERNAME",
-          "description": "Your Untappd username or login email.",
-          "isRequired": true,
+          "description": "Your Untappd username or login email. Required unless UNTAPPD_ACCESS_TOKEN is set.",
+          "isRequired": false,
           "format": "string",
           "isSecret": false
         },
         {
           "name": "UNTAPPD_PASSWORD",
-          "description": "Your Untappd account password (used only for xauth login).",
-          "isRequired": true,
+          "description": "Your Untappd account password (used only for xauth login). Required unless UNTAPPD_ACCESS_TOKEN is set.",
+          "isRequired": false,
           "format": "string",
           "isSecret": true
         },
         {
           "name": "UNTAPPD_CLIENT_ID",
-          "description": "Untappd mobile app client id (obtained by intercepting the app; see README).",
-          "isRequired": true,
+          "description": "Untappd mobile app client id (obtained by intercepting the app; see README). Needed to log in with username/password and for every write; a pre-seeded access token can read without it.",
+          "isRequired": false,
           "format": "string",
           "isSecret": true
         },
         {
           "name": "UNTAPPD_CLIENT_SECRET",
-          "description": "Untappd mobile app client secret.",
-          "isRequired": true,
+          "description": "Untappd mobile app client secret. Needed to log in with username/password and for every write; a pre-seeded access token can read without it.",
+          "isRequired": false,
           "format": "string",
           "isSecret": true
+        },
+        {
+          "name": "UNTAPPD_DEVICE_ID",
+          "description": "Stable device UUID the token is keyed to (a default is provided).",
+          "isRequired": false,
+          "format": "string",
+          "isSecret": false
+        },
+        {
+          "name": "UNTAPPD_UTV",
+          "description": "API version param (default 4.0.0).",
+          "isRequired": false,
+          "format": "string",
+          "isSecret": false
+        },
+        {
+          "name": "UNTAPPD_USER_AGENT",
+          "description": "Override the User-Agent (default mimics the app).",
+          "isRequired": false,
+          "format": "string",
+          "isSecret": false
+        },
+        {
+          "name": "UNTAPPD_TIMEZONE",
+          "description": "IANA timezone (e.g. America/New_York) that check-ins are stamped with when the call doesn't pass timezone. Set it when the server runs somewhere other than the drinker's zone (e.g. a hosted connector, usually UTC). Defaults to the server process's zone.",
+          "isRequired": false,
+          "format": "string",
+          "isSecret": false
+        },
+        {
+          "name": "UNTAPPD_PHOTO_DIR",
+          "description": "The directory untappd_checkin's photo_path must be inside (several allowed, separated by :). Defaults to ~/Downloads/untappd-mcp — put a photo there to attach it. Any other file is refused, so a prompt-injected shout or comment can't publish an arbitrary image from your disk.",
+          "isRequired": false,
+          "format": "string",
+          "isSecret": false
+        },
+        {
+          "name": "UNTAPPD_CACHE_DB",
+          "description": "Path to the local check-in cache SQLite file (default ~/.untappd-mcp/checkins.db; created owner-only — dir 0700, file 0600). Local/stdio only.",
+          "isRequired": false,
+          "format": "string",
+          "isSecret": false
         }
       ]
     }

package/skills/untappd-mcp/SKILL.md

@@ -5,19 +5,35 @@ description: Search Untappd beers, breweries, and venues; read user profiles, ch
 
 # Untappd MCP
 
-Talks to Untappd's mobile (v4) API using your own account. Logs in via the app's
-`xauth` endpoint (username + password → access token) and calls the same
-endpoints the iPad app uses.
+Talks to Untappd's mobile (v4) API using your own account, calling the same
+endpoints the iPad app uses. Authenticates with an access token you already
+hold, or mints one via the app's `xauth` endpoint (username + password).
 
 ## Setup
 
-Set four environment variables (see the README for details):
+Environment variables (the README has the full table and how to capture the
+client credentials):
 
-- `UNTAPPD_USERNAME`, `UNTAPPD_PASSWORD` — your Untappd login.
-- `UNTAPPD_CLIENT_ID`, `UNTAPPD_CLIENT_SECRET` — the Untappd mobile app client
-  credentials (obtained by intercepting the app's traffic; see README).
+| Variable | Needed | Purpose |
+|---|---|---|
+| `UNTAPPD_ACCESS_TOKEN` | no | A token you already hold. With it, **no password is needed** — xauth is skipped. When it expires, the server says so; supply a fresh one. |
+| `UNTAPPD_USERNAME`, `UNTAPPD_PASSWORD` | if no token | Your Untappd login, used only to mint a token. Accounts with 2FA can't log in this way. |
+| `UNTAPPD_CLIENT_ID`, `UNTAPPD_CLIENT_SECRET` | for login & writes | The Untappd mobile app's client credentials. A pre-seeded token can read without them. |
+| `UNTAPPD_TIMEZONE` | no | IANA zone check-ins are stamped with when a call omits `timezone`. Defaults to the server's zone. |
+| `UNTAPPD_PHOTO_DIR` | no | Directory (or `:`-separated list) a check-in's `photo_path` must be inside. Default `~/Downloads/untappd-mcp`. |
+| `UNTAPPD_CACHE_DB` | no | Local check-in cache file (default `~/.untappd-mcp/checkins.db`). Local/stdio only. |
 
-Run `untappd_healthcheck` to confirm login works.
+Two things the server enforces that you should plan around:
+
+- **Photos:** `untappd_checkin`'s `photo_path` must be a file inside
+  `UNTAPPD_PHOTO_DIR` (default `~/Downloads/untappd-mcp`); anything else (e.g.
+  `~/Pictures/beer.jpg`) is refused. Ask the user to move the photo there first.
+- **Time zone:** on a hosted connector the server usually runs in UTC, so pass
+  `timezone` (the drinker's IANA zone, e.g. `America/New_York`) on
+  `untappd_checkin` unless `UNTAPPD_TIMEZONE` is set — otherwise the check-in is
+  stamped in the server's zone.
+
+Run `untappd_healthcheck` to confirm auth works.
 
 ## Read tools
 
@@ -143,7 +159,7 @@ parameter, because an undeclared key is dropped by zod without a warning:
 ## Write tools (confirmation-gated — these post to your public account)
 
 Each asks the user to confirm first. Where the client can show a confirmation
-prompt, it does. Otherwise the first call makes NO network call and returns
+prompt, it does (unless the server sets `MCP_CONFIRM_ELICITATION=off`). Otherwise the first call makes NO network call and returns
 `status: "confirmation-required"` with a `preview` of the exact request and a
 `confirmToken`; show the preview to the user, and only after they approve call
 the tool again with the same arguments plus `confirmToken`. A token works once