untappd-mcp 2.3.1 → 2.3.2

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Untappd — beers, breweries, venues, check-ins, wishlists, and your friend feed",
-    "version": "2.3.1"
+    "version": "2.3.2"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Untappd",
       "source": "./",
       "description": "MCP server for Untappd — search beers/breweries/venues, read profiles/check-ins/wishlists, and post check-ins, toasts, and comments",
-      "version": "2.3.1",
+      "version": "2.3.2",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "untappd-mcp",
   "displayName": "Untappd",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "MCP server for Untappd — search beers/breweries/venues, read check-ins and wishlists, and post check-ins, toasts, and comments",
   "author": {
     "name": "Chris Hall",

package/.mcp.json

@@ -1,8 +1,8 @@
 {
   "mcpServers": {
     "untappd": {
-      "command": "node",
-      "args": ["${CLAUDE_PLUGIN_ROOT}/dist/index.js"],
+      "command": "npx",
+      "args": ["-y", "untappd-mcp"],
       "env": {
         "UNTAPPD_ACCESS_TOKEN": "${UNTAPPD_ACCESS_TOKEN}",
         "UNTAPPD_USERNAME": "${UNTAPPD_USERNAME}",

package/README.md

@@ -37,7 +37,7 @@ it goes stale.
 | `UNTAPPD_USER_AGENT` | no | Override the User-Agent (default mimics the app). |
 | `UNTAPPD_TIMEZONE` | no | IANA timezone (e.g. `America/New_York`) that check-ins are stamped with when the call doesn't pass `timezone`. Set it when the server runs somewhere other than the drinker's zone (e.g. a hosted connector, usually UTC). Defaults to the server process's zone. |
 | `UNTAPPD_PHOTO_DIR` | no | The directory `untappd_checkin`'s `photo_path` must be inside (several allowed, separated by `:`). Defaults to `~/Downloads/untappd-mcp` — put a photo there to attach it. Any other file is refused, so a prompt-injected shout or comment can't publish an arbitrary image from your disk. |
-| `UNTAPPD_CACHE_DB` | no | Path to the local check-in cache SQLite file (default `~/.untappd-mcp/checkins.db`; created owner-only — dir `0700`, file `0600`). Local/stdio only. |
+| `UNTAPPD_CACHE_DB` | no | Path to the local check-in cache SQLite file (default `~/.untappd-mcp/checkins.db`). The db file is always made owner-only (`0600`), and so are any directories the server creates plus the default `~/.untappd-mcp`; a directory you point this into that already exists keeps its permissions. Local/stdio only. |
 
 Copy `.env.example` to `.env` and fill it in for local use.
 

package/dist/bundle.js

@@ -84,6 +84,7 @@ var require_util = __commonJS({
     exports.explicitlyAborted = explicitlyAborted2;
     exports.prefixIssues = prefixIssues2;
     exports.unwrapMessage = unwrapMessage2;
+    exports.sizeCaps = sizeCaps2;
     exports.attachSchema = attachSchema2;
     exports.finalizeIssue = finalizeIssue2;
     exports.getSizableOrigin = getSizableOrigin2;
@@ -618,6 +619,18 @@ var require_util = __commonJS({
     function unwrapMessage2(message) {
       return typeof message === "string" ? message : message?.message;
     }
+    function sizeCaps2(defChecks) {
+      const caps = [];
+      for (const ch of defChecks ?? []) {
+        const d = ch._zod.def;
+        if (!/_(length|size)$|_equals$/.test(d.check))
+          break;
+        const max = d.maximum ?? d.length ?? d.size;
+        if (max >= 0)
+          caps.push([max, ch]);
+      }
+      return caps;
+    }
     function attachSchema2(issues, start, inst) {
       var _a3;
       for (let i = start; i < issues.length; i++) {
@@ -2282,7 +2295,7 @@ var require_versions = __commonJS({
     exports.version = {
       major: 4,
       minor: 6,
-      patch: 5
+      patch: 6
     };
     (function() {
       var keys = Object.getOwnPropertyNames(exports);
@@ -3116,6 +3129,31 @@ var require_schemas = __commonJS({
         return payload;
       };
     });
+    function capSize2(inst, size) {
+      const caps = util.sizeCaps(inst._zod.def.checks);
+      if (!caps.length)
+        return;
+      const cap = Math.min(...caps.map((c) => c[0]));
+      const parse3 = inst._zod.parse;
+      inst._zod.parse = (payload, ctx) => {
+        const n = size(payload.value);
+        if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+          for (const [max, ch] of util.sizeCaps(inst._zod.def.checks)) {
+            if (n > max && ch._zod.def.when(payload)) {
+              const start = payload.issues.length;
+              ch._zod.check(payload);
+              payload.issues[start].continue = false;
+              util.attachSchema(payload.issues, start, inst);
+              return payload;
+            }
+          }
+        }
+        return parse3(payload, ctx);
+      };
+    }
+    var arraySize2 = (input2) => Array.isArray(input2) ? input2.length : -1;
+    var mapSize2 = (input2) => input2 instanceof Map ? input2.size : -1;
+    var setSize2 = (input2) => input2 instanceof Set ? input2.size : -1;
     function handleArrayResult2(result, final, index) {
       if (result.issues.length) {
         final.issues.push(...util.prefixIssues(index, result.issues));
@@ -3159,6 +3197,7 @@ var require_schemas = __commonJS({
         }
         return payload;
       };
+      capSize2(inst, arraySize2);
     });
     function handlePropertyResult2(result, final, key, input2, optin, optout) {
       const isPresent = key in input2;
@@ -4115,6 +4154,7 @@ var require_schemas = __commonJS({
           return Promise.all(proms).then(() => payload);
         return payload;
       };
+      capSize2(inst, mapSize2);
     });
     function handleMapResult2(keyResult, valueResult, final, key, input2, inst, ctx) {
       if (keyResult.issues.length) {
@@ -4181,6 +4221,7 @@ var require_schemas = __commonJS({
           return Promise.all(proms).then(() => payload);
         return payload;
       };
+      capSize2(inst, setSize2);
     });
     function handleSetResult2(result, final) {
       if (result.issues.length) {
@@ -4851,7 +4892,7 @@ var require_memoizer = __commonJS({
     var NONE2 = 0;
     var ASSUMED2 = 1;
     var PROVEN2 = 2;
-    function isRecursive2(inst, stack, resolve3) {
+    function isRecursive2(inst, stack, resolve4) {
       const cached2 = recursive2.get(inst);
       if (cached2 !== void 0)
         return cached2 ? PROVEN2 : NONE2;
@@ -4861,7 +4902,7 @@ var require_memoizer = __commonJS({
       let result = NONE2;
       const check2 = (child) => {
         if (result !== PROVEN2 && child?._zod) {
-          const answer = isRecursive2(child, stack, resolve3);
+          const answer = isRecursive2(child, stack, resolve4);
           if (answer > result)
             result = answer;
         }
@@ -4872,7 +4913,7 @@ var require_memoizer = __commonJS({
           const desc = Object.getOwnPropertyDescriptor(sh, key);
           if (spread && !desc.enumerable)
             continue;
-          const child = desc.get ? ASSUMED2 : desc.value?._zod ? isRecursive2(desc.value, stack, resolve3) : NONE2;
+          const child = desc.get ? ASSUMED2 : desc.value?._zod ? isRecursive2(desc.value, stack, resolve4) : NONE2;
           if (child > answer)
             answer = child;
         }
@@ -4936,7 +4977,7 @@ var require_memoizer = __commonJS({
           break;
         // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
         case "lazy": {
-          const inner = def._cachedInner ?? (resolve3 ? inst._zod.innerType : void 0);
+          const inner = def._cachedInner ?? (resolve4 ? inst._zod.innerType : void 0);
           merge2(inner ? isRecursive2(inner, stack, false) : ASSUMED2);
           break;
         }
@@ -16285,9 +16326,15 @@ ${code2}
       doc.write(`}`);
       return outputVar;
     }
+    function generateSizeGate2(doc, schema, size) {
+      for (const [max, check2] of util.sizeCaps(schema._zod.def.checks)) {
+        doc.write(`if (${size} > ${numericOperand2(max, check2._zod.def.check)}) return INVALID;`);
+      }
+    }
     function generateArrayCheck2(doc, ctx, schema, accessor, buildsValue = true) {
       const def = schema._zod.def;
       doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+      generateSizeGate2(doc, schema, `${accessor}.length`);
       const outputVar = buildsValue ? newVar2(ctx) : null;
       const iVar = newVar2(ctx);
       const elemVar = newVar2(ctx);
@@ -16687,6 +16734,7 @@ ${code2}
     function generateMapCheck2(doc, ctx, schema, accessor) {
       const def = schema._zod.def;
       doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+      generateSizeGate2(doc, schema, `${accessor}.size`);
       const outputVar = newVar2(ctx);
       const kVar = newVar2(ctx);
       const valVar = newVar2(ctx);
@@ -16703,6 +16751,7 @@ ${code2}
     function generateSetCheck2(doc, ctx, schema, accessor) {
       const def = schema._zod.def;
       doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+      generateSizeGate2(doc, schema, `${accessor}.size`);
       const outputVar = newVar2(ctx);
       const valVar = newVar2(ctx);
       doc.write(`const ${outputVar} = new Set();`);
@@ -23400,7 +23449,7 @@ function declaredDialect(schema, remedy) {
   throw new Error(`JSON Schema declares an unsupported dialect ("$schema": "${schema.$schema.slice(0, 200)}"). The default validator supports JSON Schema 2020-12, 2019-09, draft-07, and draft-06; ${remedy}`);
 }
 
-// node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs
+// node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs
 var z = __toESM(require_v4(), 1);
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [
@@ -27799,14 +27848,14 @@ function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep(ms, signal) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve3();
+      resolve4();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -28605,7 +28654,7 @@ var Protocol = class {
     const flowStartedAt = Date.now();
     let onAbort;
     let cleanupMessageId;
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       const earlyReject = (error62) => {
         reject(error62);
       };
@@ -28674,7 +28723,7 @@ var Protocol = class {
         }
         if (decoded.kind === "invalid") return reject(decoded.error);
         if (decoded.kind === "input_required") {
-          if (options?.allowInputRequired === true) return resolve3(manualInputRequiredValue(decoded));
+          if (options?.allowInputRequired === true) return resolve4(manualInputRequiredValue(decoded));
           const flow = {
             codec: codec2,
             request,
@@ -28686,11 +28735,11 @@ var Protocol = class {
               params
             }, resultSchema, legOptions)
           };
-          return resolve3(this._resolveNonCompleteResult(decoded, flow));
+          return resolve4(this._resolveNonCompleteResult(decoded, flow));
         }
         const result = decoded.result;
         validateStandardSchema(resultSchema, result).then((parseResult) => {
-          if (parseResult.success) resolve3(parseResult.data);
+          if (parseResult.success) resolve4(parseResult.data);
           else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
         }, reject);
       });
@@ -31606,7 +31655,7 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin(((exports) => {
     ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
     const schOrFunc = root.refs[ref];
     if (schOrFunc) return schOrFunc;
-    let _sch = resolve3.call(this, root, ref);
+    let _sch = resolve4.call(this, root, ref);
     if (_sch === void 0) {
       const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
       const { schemaId } = this.opts;
@@ -31632,7 +31681,7 @@ var require_compile2 = /* @__PURE__ */ __commonJSMin(((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve3(root, ref) {
+  function resolve4(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string") ref = sch;
     return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -32082,7 +32131,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     else if (typeof uri === "object") uri = parse3(serialize(uri, options), options);
     return uri;
   }
-  function resolve3(baseURI, relativeURI, options) {
+  function resolve4(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
@@ -32256,7 +32305,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
   const fastUri = {
     SCHEMES,
     normalize,
-    resolve: resolve3,
+    resolve: resolve4,
     resolveComponent,
     equal,
     serialize,
@@ -37718,7 +37767,7 @@ var StdioServerTransport = class {
   }
   send(message) {
     if (this._closed) return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       const json2 = serializeMessage(message);
       let settled = false;
       const onError = (error62) => {
@@ -37733,14 +37782,14 @@ var StdioServerTransport = class {
         settled = true;
         this._stdout.off("error", onError);
         this._stdout.off("drain", onDrain);
-        resolve3();
+        resolve4();
       };
       this._stdout.once("error", onError);
       if (this._stdout.write(json2)) {
         if (settled) return;
         settled = true;
         this._stdout.off("error", onError);
-        resolve3();
+        resolve4();
       } else if (!settled) this._stdout.once("drain", onDrain);
     });
   }
@@ -37794,14 +37843,14 @@ var StdioConnectionChannel = class {
   */
   async whenRequestsAnswered(timeoutMs) {
     if (this._closed || this._pendingRequests.size === 0) return true;
-    return await new Promise((resolve3) => {
+    return await new Promise((resolve4) => {
       const waiter = () => {
         clearTimeout(timer);
-        resolve3(true);
+        resolve4(true);
       };
       const timer = setTimeout(() => {
         this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
-        resolve3(false);
+        resolve4(false);
       }, timeoutMs);
       this._drainWaiters.push(waiter);
     });
@@ -38216,7 +38265,7 @@ var API_KEY_RE = new RegExp([
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
 var GOOGLE_OAUTH_TOKEN_RE = /(?<![A-Za-z0-9+/])(?:ya29\.|1\/\/)[A-Za-z0-9._-]{8,}/g;
-var QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
+var QUERY_SECRET_RE = new RegExp(`([?&#;](?:(?:access|refresh|id|auth|session|csrf|xsrf|api)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|secret|token|auth|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
 var OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
 var FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
 var HEADER_SECRET_RE = new RegExp(`(\\b(?:x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN}|api[-_]?key)\\s*:\\s*)[^\\s,;"'<>\`]+`, "gi");
@@ -38227,6 +38276,8 @@ var JSON_SECRET_KEYS = [
   "api[_-]?secret",
   "(?:x[_-])?api[_-]?key",
   "private[_-]?key",
+  "aws[_-]?secret[_-]?access[_-]?key",
+  // fleet-audit#1297
   "code[_-]?verifier",
   // PKCE; a bare `verifier` key is too generic for JSON
   `x[_-]${HEADER_NAME_RUN}?(?:api[_-]?key|token|secret|auth)${HEADER_NAME_RUN}`,
@@ -38924,6 +38975,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -39443,6 +39495,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a3;
   for (let i = start; i < issues.length; i++) {
@@ -40863,7 +40927,7 @@ ${content.join("\n")}
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 6
 };
 
 // node_modules/zod/v4/core/schemas.js
@@ -41619,6 +41683,31 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse3 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse3(payload, ctx);
+  };
+}
+var arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
+var mapSize = (input2) => input2 instanceof Map ? input2.size : -1;
+var setSize = (input2) => input2 instanceof Set ? input2.size : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -41662,6 +41751,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input2, optin, optout) {
   const isPresent = key in input2;
@@ -42618,6 +42708,7 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input2, inst, ctx) {
   if (keyResult.issues.length) {
@@ -42684,6 +42775,7 @@ var $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
   if (result.issues.length) {
@@ -43299,7 +43391,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve3) {
+function isRecursive(inst, stack, resolve4) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -43309,7 +43401,7 @@ function isRecursive(inst, stack, resolve3) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve3);
+      const answer = isRecursive(child, stack, resolve4);
       if (answer > result)
         result = answer;
     }
@@ -43320,7 +43412,7 @@ function isRecursive(inst, stack, resolve3) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve3) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve4) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -43384,7 +43476,7 @@ function isRecursive(inst, stack, resolve3) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve3 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve4 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -52214,9 +52306,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check2] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check2._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -52616,6 +52714,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -52632,6 +52731,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -58958,7 +59058,7 @@ function toolAnnotations(opts = {}) {
 }
 
 // src/version.ts
-var VERSION = "2.3.1";
+var VERSION = "2.3.2";
 
 // src/client.ts
 import { dirname as dirname2, join as join4 } from "path";
@@ -61816,7 +61916,7 @@ function registerCacheTools(server, client2, cacheProvider) {
 // src/cache/db.ts
 import { DatabaseSync } from "node:sqlite";
 import { chmodSync, closeSync as closeSync2, existsSync as existsSync2, mkdirSync as mkdirSync3, openSync as openSync2 } from "node:fs";
-import { dirname as dirname3, join as join6 } from "node:path";
+import { dirname as dirname3, join as join6, resolve as resolve3 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 var NodeSqlDriver = class {
   constructor(db) {
@@ -61869,8 +61969,9 @@ var CheckinCache = class _CheckinCache extends LocalCacheStore {
 };
 function preparePrivateFile(path) {
   const dir = dirname3(path);
+  const dirExisted = existsSync2(dir);
   mkdirSync3(dir, { recursive: true, mode: 448 });
-  bestEffortChmod(dir, 448);
+  if (!dirExisted || resolve3(dir) === resolve3(defaultCacheDir())) bestEffortChmod(dir, 448);
   if (!existsSync2(path)) closeSync2(openSync2(path, "a", 384));
   bestEffortChmod(path, 384);
 }
@@ -61886,7 +61987,10 @@ function bestEffortChmod(path, mode) {
   }
 }
 function defaultCachePath() {
-  return readEnvVar("UNTAPPD_CACHE_DB") ?? join6(homedir3(), ".untappd-mcp", "checkins.db");
+  return readEnvVar("UNTAPPD_CACHE_DB") ?? join6(defaultCacheDir(), "checkins.db");
+}
+function defaultCacheDir() {
+  return join6(homedir3(), ".untappd-mcp");
 }
 
 // src/index.ts

package/dist/cache/db.js

@@ -1,6 +1,6 @@
 import { DatabaseSync } from 'node:sqlite';
 import { chmodSync, closeSync, existsSync, mkdirSync, openSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { readEnvVar } from '@chrischall/mcp-utils';
 import { CheckinStoreCore, LocalCacheStore } from './store.js';
@@ -66,14 +66,19 @@ export class CheckinCache extends LocalCacheStore {
 /**
  * Create the cache's directory (0700 — `mode` applies to every dir mkdir
  * creates) and the db file itself (0600) BEFORE SQLite opens it, so the file is
- * never briefly umask-readable. Pre-existing loose entries from older versions
- * are tightened too; chmod failures (e.g. a shared dir the user doesn't own)
- * are best-effort, never fatal.
+ * never briefly umask-readable. The db file is always tightened, and so is the
+ * server's own default directory (`~/.untappd-mcp`, which an older version may
+ * have left loose). A directory the user pointed `UNTAPPD_CACHE_DB` into that
+ * already existed is left as it is: it may hold other files (a shared Dropbox
+ * folder), and making it owner-only would break access to them. chmod failures
+ * (e.g. a shared dir the user doesn't own) are best-effort, never fatal.
  */
 function preparePrivateFile(path) {
     const dir = dirname(path);
+    const dirExisted = existsSync(dir);
     mkdirSync(dir, { recursive: true, mode: 0o700 });
-    bestEffortChmod(dir, 0o700);
+    if (!dirExisted || resolve(dir) === resolve(defaultCacheDir()))
+        bestEffortChmod(dir, 0o700);
     if (!existsSync(path))
         closeSync(openSync(path, 'a', 0o600));
     bestEffortChmod(path, 0o600);
@@ -95,8 +100,12 @@ function bestEffortChmod(path, mode) {
 }
 /** Default on-disk cache path: `$UNTAPPD_CACHE_DB` or `~/.untappd-mcp/checkins.db`. */
 export function defaultCachePath() {
-    return readEnvVar('UNTAPPD_CACHE_DB') ?? join(homedir(), '.untappd-mcp', 'checkins.db');
+    return readEnvVar('UNTAPPD_CACHE_DB') ?? join(defaultCacheDir(), 'checkins.db');
 }
 // Re-export the shared types/helpers tests and tools import from here so their
 // existing import paths keep working.
 export { mapCheckinRow, } from './store.js';
+/** The directory the server owns by default: `~/.untappd-mcp`. */
+function defaultCacheDir() {
+    return join(homedir(), '.untappd-mcp');
+}

package/dist/version.js

@@ -3,4 +3,4 @@
 // json's `extra-files`), and `versionSyncTest` guards that it stays equal to
 // package.json. Import VERSION wherever the version is needed rather than
 // re-declaring it.
-export const VERSION = '2.3.1'; // x-release-please-version
+export const VERSION = '2.3.2'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "untappd-mcp",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "mcpName": "io.github.chrischall/untappd-mcp",
   "description": "Untappd MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -45,7 +45,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^3.0.0",
+    "@chrischall/mcp-utils": "^3.0.3",
     "@modelcontextprotocol/server": "^2.3.0",
     "dotenv": "^18.0.1",
     "zod": "^4.6.5"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/untappd-mcp",
     "source": "github"
   },
-  "version": "2.3.1",
+  "version": "2.3.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "untappd-mcp",
-      "version": "2.3.1",
+      "version": "2.3.2",
       "transport": {
         "type": "stdio"
       },

package/skills/untappd-mcp/SKILL.md

@@ -5,19 +5,35 @@ description: Search Untappd beers, breweries, and venues; read user profiles, ch
 
 # Untappd MCP
 
-Talks to Untappd's mobile (v4) API using your own account. Logs in via the app's
-`xauth` endpoint (username + password → access token) and calls the same
-endpoints the iPad app uses.
+Talks to Untappd's mobile (v4) API using your own account, calling the same
+endpoints the iPad app uses. Authenticates with an access token you already
+hold, or mints one via the app's `xauth` endpoint (username + password).
 
 ## Setup
 
-Set four environment variables (see the README for details):
-
-- `UNTAPPD_USERNAME`, `UNTAPPD_PASSWORD` — your Untappd login.
-- `UNTAPPD_CLIENT_ID`, `UNTAPPD_CLIENT_SECRET` — the Untappd mobile app client
-  credentials (obtained by intercepting the app's traffic; see README).
-
-Run `untappd_healthcheck` to confirm login works.
+Environment variables (the README has the full table and how to capture the
+client credentials):
+
+| Variable | Needed | Purpose |
+|---|---|---|
+| `UNTAPPD_ACCESS_TOKEN` | no | A token you already hold. With it, **no password is needed** — xauth is skipped. When it expires, the server says so; supply a fresh one. |
+| `UNTAPPD_USERNAME`, `UNTAPPD_PASSWORD` | if no token | Your Untappd login, used only to mint a token. Accounts with 2FA can't log in this way. |
+| `UNTAPPD_CLIENT_ID`, `UNTAPPD_CLIENT_SECRET` | for login & writes | The Untappd mobile app's client credentials. A pre-seeded token can read without them. |
+| `UNTAPPD_TIMEZONE` | no | IANA zone check-ins are stamped with when a call omits `timezone`. Defaults to the server's zone. |
+| `UNTAPPD_PHOTO_DIR` | no | Directory (or `:`-separated list) a check-in's `photo_path` must be inside. Default `~/Downloads/untappd-mcp`. |
+| `UNTAPPD_CACHE_DB` | no | Local check-in cache file (default `~/.untappd-mcp/checkins.db`). Local/stdio only. |
+
+Two things the server enforces that you should plan around:
+
+- **Photos:** `untappd_checkin`'s `photo_path` must be a file inside
+  `UNTAPPD_PHOTO_DIR` (default `~/Downloads/untappd-mcp`); anything else (e.g.
+  `~/Pictures/beer.jpg`) is refused. Ask the user to move the photo there first.
+- **Time zone:** on a hosted connector the server usually runs in UTC, so pass
+  `timezone` (the drinker's IANA zone, e.g. `America/New_York`) on
+  `untappd_checkin` unless `UNTAPPD_TIMEZONE` is set — otherwise the check-in is
+  stamped in the server's zone.
+
+Run `untappd_healthcheck` to confirm auth works.
 
 ## Read tools