vibo-mcp 1.1.0 → 1.3.0

package/.claude-plugin/marketplace.json

@@ -6,16 +6,16 @@
     "email": "chris.c.hall@gmail.com"
   },
   "metadata": {
-    "description": "MCP server for Vibo (vibodj.com) — plan event music, song requests, and playlists via natural language",
-    "version": "1.1.0"
+    "description": "MCP server for Vibo (vibodj.com) — plan & manage event music, song requests, ideas, guests, and playlists via natural language",
+    "version": "1.3.0"
   },
   "plugins": [
     {
       "name": "vibo-mcp",
       "displayName": "Vibo",
       "source": "./",
-      "description": "MCP server for Vibo — browse events and timelines, add/like song requests, and export to Spotify/Apple Music",
-      "version": "1.1.0",
+      "description": "MCP server for Vibo — browse & manage events, timeline, songs, the DJ song ideas/questions, guests, and exports to Spotify/Apple Music",
+      "version": "1.3.0",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "name": "vibo-mcp",
   "displayName": "Vibo",
-  "version": "1.1.0",
-  "description": "MCP server for Vibo (vibodj.com) — plan event music, song requests, and playlists via natural language",
+  "version": "1.3.0",
+  "description": "MCP server for Vibo (vibodj.com) — plan & manage event music, song requests, ideas, guests, and playlists via natural language",
   "author": {
     "name": "Chris Hall",
     "email": "chris.c.hall@gmail.com"

package/README.md

@@ -33,6 +33,7 @@ Choose one method:
 |--------|----------|------|
 | Email + password (recommended) | `VIBO_EMAIL`, `VIBO_PASSWORD` | You sign in to Vibo with an email/password. |
 | Captured token | `VIBO_ACCESS_TOKEN` (+ `VIBO_REFRESH_TOKEN`) | Your account uses Apple/Google/Facebook sign-in (no password). Capture `x-token`/`x-refresh-token` from a signed-in `web.vibodj.com` session. |
+| Browser capture (SSO) | run `vibo_capture_session` | With the fetchproxy browser extension installed and signed into `web.vibodj.com`, capture the token automatically (saved to `~/.vibo-mcp/session.json`). |
 
 The server boots without credentials; the config error only surfaces on the
 first tool call.

package/SKILL.md

@@ -40,6 +40,10 @@ Pick one:
 - **Captured token (for Apple/Google/Facebook accounts):** set
   `VIBO_ACCESS_TOKEN` (and `VIBO_REFRESH_TOKEN`) with values captured from a
   signed-in `web.vibodj.com` session — no password needed.
+- **Browser capture (SSO, automatic):** with the fetchproxy browser extension
+  installed and yourself signed into https://web.vibodj.com, run
+  `vibo_capture_session` once — it grabs the token from your tab (approve the
+  pair code), saves it to `~/.vibo-mcp/session.json`, and reuses it thereafter.
 
 The server boots without credentials (so it can be installed and probed); the
 config error only appears on the first tool call.
@@ -54,7 +58,9 @@ config error only appears on the first tool call.
 - `vibo_get_section_songs` — songs requested in a section, with likes/flags/comments.
 - `vibo_list_section_questions` — the DJ's planning questions for a section (type, options, current answer).
 - `vibo_search_songs` — find songs to add (Vibo catalog or connected Spotify).
+- `vibo_list_section_song_ideas` / `vibo_list_song_ideas_songs` — browse the DJ's suggested song collections per section.
 - `vibo_get_playlists` / `vibo_get_playlist_songs` — your connected-service playlists.
+- `vibo_list_event_users` — the hosts and guests on an event.
 - `vibo_list_notifications` / `vibo_get_notifications_count`.
 - `vibo_healthcheck` — confirm connectivity + auth.
 
@@ -63,11 +69,19 @@ Each mutating tool makes **no** network call unless `confirm: true`; without it
 you get a dry-run preview of exactly what would be sent.
 
 - `vibo_add_song_to_section` — add a searched song to a section.
+- `vibo_remove_song_from_section` / `vibo_move_song` / `vibo_reorder_songs`.
+- `vibo_update_song` — mark must-play / do-not-play, or set a comment.
 - `vibo_toggle_song_like` — like/unlike a song.
+- `vibo_comment_on_song` / `vibo_comment_on_section` (+ delete) — leave the DJ notes.
+- `vibo_import_playlist_to_section` — pull tracks from a connected Spotify/Apple playlist.
 - `vibo_join_event` — join via a share link/hash (e.g. a `vibodj.app.link/...` URL).
 - `vibo_leave_event`.
 - `vibo_create_event_contact` — add a host/guest contact.
-- `vibo_answer_question` — answer a section planning question (text / option ids / link).
+- `vibo_invite_users` / `vibo_change_user_role` / `vibo_remove_user` — manage who's on the event.
+- `vibo_update_section` — edit a section's name, time, or note.
+- `vibo_answer_question` — answer a planning question (text / option ids / link / image+file uploads).
+- `vibo_set_profile_photo` — set your profile photo from a local image.
+- `vibo_capture_session` — capture your login from a signed-in browser tab (SSO accounts).
 - `vibo_mark_notifications_read`.
 - `vibo_export_event_to_spotify` / `vibo_export_event_to_apple_music`.
 

package/dist/auth.js

@@ -0,0 +1,71 @@
+// SSO browser token auto-capture (fetchproxy bootstrap).
+//
+// Accounts that sign into Vibo only via Apple/Google/Facebook have no password
+// to put in VIBO_PASSWORD. Instead of asking the user to dig the token out of
+// DevTools and paste VIBO_ACCESS_TOKEN, this captures it once from their
+// signed-in web.vibodj.com tab via the fetchproxy browser bridge, then operates
+// from Node thereafter (the bridge touches only the one-time handshake).
+//
+// The Vibo web app stores its tokens as plain localStorage keys `x-token`
+// (access) and `x-refresh-token` on the web.vibodj.com origin (verified live
+// against a signed-in tab). We snapshot those two keys and return them; the caller verifies
+// them (GET_ME) and only then persists via session-store. The client then uses
+// them like any other token pair (with refresh-on-expiry).
+//
+// `@fetchproxy/bootstrap` is imported lazily so the default credential paths
+// never load it — the .mcpb bundle externalizes it, and an eager import would
+// crash the server at load. Tests inject a fake `bootstrap` via `deps`.
+import { McpToolError } from '@chrischall/mcp-utils';
+import { VERSION } from './version.js';
+const SERVER_NAME = 'vibo-mcp';
+/**
+ * Capture the signed-in user's Vibo token pair from their browser via the
+ * fetchproxy bridge and return it (the caller persists after verifying).
+ * Preconditions: the fetchproxy browser
+ * extension is installed and the user is signed into https://web.vibodj.com.
+ */
+export async function captureViboSession(deps = {}) {
+    let bootstrap = deps.bootstrap;
+    if (!bootstrap) {
+        try {
+            const mod = (await import('@fetchproxy/bootstrap'));
+            bootstrap = mod.bootstrap;
+        }
+        catch (err) {
+            throw new McpToolError('Browser token capture is unavailable in this build.', {
+                hint: 'Run vibo-mcp from npm (npx vibo-mcp) — the packaged .mcpb omits @fetchproxy/bootstrap. Or set VIBO_ACCESS_TOKEN instead.',
+                cause: err,
+            });
+        }
+    }
+    let session;
+    try {
+        session = await bootstrap({
+            serverName: SERVER_NAME,
+            version: VERSION,
+            domains: ['vibodj.com'],
+            storageSubdomain: 'web', // tokens live on web.vibodj.com
+            declare: { cookies: [], localStorage: ['x-token', 'x-refresh-token'], sessionStorage: [], captureHeaders: [] },
+            onPairCode: (code) => process.stderr.write(`[vibo-mcp] fetchproxy pair code: ${code}\n`),
+            onWaiting: (hint) => process.stderr.write(`[vibo-mcp] ${hint}\n`),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new McpToolError(`Vibo browser token capture failed: ${msg}`, {
+            hint: 'Install the fetchproxy browser extension, sign into https://web.vibodj.com, approve the pair code, then retry.',
+            cause: err,
+        });
+    }
+    const accessToken = session.localStorage?.['x-token'];
+    const refreshToken = session.localStorage?.['x-refresh-token'] ?? null;
+    if (!accessToken) {
+        throw new McpToolError('No Vibo token found in the signed-in browser tab.', {
+            hint: 'Make sure you are signed into https://web.vibodj.com in the browser with the fetchproxy extension, then retry.',
+        });
+    }
+    // Return the captured pair WITHOUT persisting — the caller verifies it
+    // (GET_ME) before writing it to disk, so a stale snapshot never lands in
+    // session.json.
+    return { accessToken, refreshToken };
+}