vibo-mcp 1.2.0 → 1.3.1

package/.claude-plugin/marketplace.json

@@ -6,16 +6,16 @@
     "email": "chris.c.hall@gmail.com"
   },
   "metadata": {
-    "description": "MCP server for Vibo (vibodj.com) — plan event music, song requests, and playlists via natural language",
-    "version": "1.2.0"
+    "description": "MCP server for Vibo (vibodj.com) — plan & manage event music, song requests, ideas, guests, and playlists via natural language",
+    "version": "1.3.1"
   },
   "plugins": [
     {
       "name": "vibo-mcp",
       "displayName": "Vibo",
       "source": "./",
-      "description": "MCP server for Vibo — browse events and timelines, add/like song requests, and export to Spotify/Apple Music",
-      "version": "1.2.0",
+      "description": "MCP server for Vibo — browse & manage events, timeline, songs, the DJ song ideas/questions, guests, and exports to Spotify/Apple Music",
+      "version": "1.3.1",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "name": "vibo-mcp",
   "displayName": "Vibo",
-  "version": "1.2.0",
-  "description": "MCP server for Vibo (vibodj.com) — plan event music, song requests, and playlists via natural language",
+  "version": "1.3.1",
+  "description": "MCP server for Vibo (vibodj.com) — plan & manage event music, song requests, ideas, guests, and playlists via natural language",
   "author": {
     "name": "Chris Hall",
     "email": "chris.c.hall@gmail.com"

package/README.md

@@ -33,6 +33,7 @@ Choose one method:
 |--------|----------|------|
 | Email + password (recommended) | `VIBO_EMAIL`, `VIBO_PASSWORD` | You sign in to Vibo with an email/password. |
 | Captured token | `VIBO_ACCESS_TOKEN` (+ `VIBO_REFRESH_TOKEN`) | Your account uses Apple/Google/Facebook sign-in (no password). Capture `x-token`/`x-refresh-token` from a signed-in `web.vibodj.com` session. |
+| Browser capture (SSO) | run `vibo_capture_session` | With the fetchproxy browser extension installed and signed into `web.vibodj.com`, capture the token automatically (saved to `~/.vibo-mcp/session.json`). |
 
 The server boots without credentials; the config error only surfaces on the
 first tool call.

package/SKILL.md

@@ -40,6 +40,10 @@ Pick one:
 - **Captured token (for Apple/Google/Facebook accounts):** set
   `VIBO_ACCESS_TOKEN` (and `VIBO_REFRESH_TOKEN`) with values captured from a
   signed-in `web.vibodj.com` session — no password needed.
+- **Browser capture (SSO, automatic):** with the fetchproxy browser extension
+  installed and yourself signed into https://web.vibodj.com, run
+  `vibo_capture_session` once — it grabs the token from your tab (approve the
+  pair code), saves it to `~/.vibo-mcp/session.json`, and reuses it thereafter.
 
 The server boots without credentials (so it can be installed and probed); the
 config error only appears on the first tool call.
@@ -77,6 +81,7 @@ you get a dry-run preview of exactly what would be sent.
 - `vibo_update_section` — edit a section's name, time, or note.
 - `vibo_answer_question` — answer a planning question (text / option ids / link / image+file uploads).
 - `vibo_set_profile_photo` — set your profile photo from a local image.
+- `vibo_capture_session` — capture your login from a signed-in browser tab (SSO accounts).
 - `vibo_mark_notifications_read`.
 - `vibo_export_event_to_spotify` / `vibo_export_event_to_apple_music`.
 

package/dist/auth.js

@@ -0,0 +1,71 @@
+// SSO browser token auto-capture (fetchproxy bootstrap).
+//
+// Accounts that sign into Vibo only via Apple/Google/Facebook have no password
+// to put in VIBO_PASSWORD. Instead of asking the user to dig the token out of
+// DevTools and paste VIBO_ACCESS_TOKEN, this captures it once from their
+// signed-in web.vibodj.com tab via the fetchproxy browser bridge, then operates
+// from Node thereafter (the bridge touches only the one-time handshake).
+//
+// The Vibo web app stores its tokens as plain localStorage keys `x-token`
+// (access) and `x-refresh-token` on the web.vibodj.com origin (verified live
+// against a signed-in tab). We snapshot those two keys and return them; the caller verifies
+// them (GET_ME) and only then persists via session-store. The client then uses
+// them like any other token pair (with refresh-on-expiry).
+//
+// `@fetchproxy/bootstrap` is imported lazily so the default credential paths
+// never load it — the .mcpb bundle externalizes it, and an eager import would
+// crash the server at load. Tests inject a fake `bootstrap` via `deps`.
+import { McpToolError } from '@chrischall/mcp-utils';
+import { VERSION } from './version.js';
+const SERVER_NAME = 'vibo-mcp';
+/**
+ * Capture the signed-in user's Vibo token pair from their browser via the
+ * fetchproxy bridge and return it (the caller persists after verifying).
+ * Preconditions: the fetchproxy browser
+ * extension is installed and the user is signed into https://web.vibodj.com.
+ */
+export async function captureViboSession(deps = {}) {
+    let bootstrap = deps.bootstrap;
+    if (!bootstrap) {
+        try {
+            const mod = (await import('@fetchproxy/bootstrap'));
+            bootstrap = mod.bootstrap;
+        }
+        catch (err) {
+            throw new McpToolError('Browser token capture is unavailable in this build.', {
+                hint: 'Run vibo-mcp from npm (npx vibo-mcp) — the packaged .mcpb omits @fetchproxy/bootstrap. Or set VIBO_ACCESS_TOKEN instead.',
+                cause: err,
+            });
+        }
+    }
+    let session;
+    try {
+        session = await bootstrap({
+            serverName: SERVER_NAME,
+            version: VERSION,
+            domains: ['vibodj.com'],
+            storageSubdomain: 'web', // tokens live on web.vibodj.com
+            declare: { cookies: [], localStorage: ['x-token', 'x-refresh-token'], sessionStorage: [], captureHeaders: [] },
+            onPairCode: (code) => process.stderr.write(`[vibo-mcp] fetchproxy pair code: ${code}\n`),
+            onWaiting: (hint) => process.stderr.write(`[vibo-mcp] ${hint}\n`),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new McpToolError(`Vibo browser token capture failed: ${msg}`, {
+            hint: 'Install the fetchproxy browser extension, sign into https://web.vibodj.com, approve the pair code, then retry.',
+            cause: err,
+        });
+    }
+    const accessToken = session.localStorage?.['x-token'];
+    const refreshToken = session.localStorage?.['x-refresh-token'] ?? null;
+    if (!accessToken) {
+        throw new McpToolError('No Vibo token found in the signed-in browser tab.', {
+            hint: 'Make sure you are signed into https://web.vibodj.com in the browser with the fetchproxy extension, then retry.',
+        });
+    }
+    // Return the captured pair WITHOUT persisting — the caller verifies it
+    // (GET_ME) before writing it to disk, so a stale snapshot never lands in
+    // session.json.
+    return { accessToken, refreshToken };
+}

package/dist/bundle.js

@@ -31040,8 +31040,12 @@ var API_KEY_RE = new RegExp([
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
 var QUERY_SECRET_RE = /([?&](?:access_token|refresh_token|client_secret|api_?key|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var AWS_SIGV4_RE = /([?&]X-Amz-(?:Signature|Security-Token|Credential)=)[^&#\s"'<>`]+/gi;
+var JSON_SECRET_KEYS = "access_token|refresh_token|client_secret|api_?key|password|passwd|secret|token";
+var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")[^"]*(")`, "gi");
+var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')[^']*(')`, "gi");
 function redactSecrets(text) {
-  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(JWT_RE, "[REDACTED]");
+  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
 }
 function truncateErrorMessage(text, max = DEFAULT_ERROR_MESSAGE_MAX) {
   const str = text === null || text === void 0 ? "" : String(text);
@@ -31116,13 +31120,187 @@ function toolAnnotations(opts = {}) {
 }
 
 // src/version.ts
-var VERSION = "1.2.0";
+var VERSION = "1.3.1";
 
 // src/client.ts
-import { dirname, join } from "path";
+import { dirname as dirname2, join as join2 } from "path";
 import { fileURLToPath } from "url";
-var __dirname = dirname(fileURLToPath(import.meta.url));
-await loadDotenvSafely({ path: join(__dirname, "..", ".env"), override: false });
+
+// src/session-store.ts
+import { homedir } from "os";
+import { join } from "path";
+
+// node_modules/@chrischall/mcp-utils/dist/session/index.js
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync } from "node:fs";
+import { dirname } from "node:path";
+function normalizeOrigin(input) {
+  try {
+    return new URL(input).origin.replace(/\/$/, "");
+  } catch {
+    return input.replace(/\/$/, "");
+  }
+}
+var SessionStore = class {
+  sessions = /* @__PURE__ */ new Map();
+  mostRecentKey = null;
+  filePath;
+  keyOf;
+  normalizeKey;
+  constructor(opts) {
+    this.filePath = opts.filePath;
+    this.keyOf = opts.keyOf;
+    this.normalizeKey = opts.normalizeKey ?? normalizeOrigin;
+    this.loadFromDisk();
+  }
+  loadFromDisk() {
+    if (!existsSync(this.filePath))
+      return;
+    try {
+      this.sessions = this.deserialize(readFileSync(this.filePath, "utf8"));
+      const keys = Array.from(this.sessions.keys());
+      this.mostRecentKey = keys[keys.length - 1] ?? null;
+    } catch (err) {
+      const backupPath = this.preserveCorruptFile();
+      const detail = err instanceof Error ? err.message : String(err);
+      console.error(`[mcp-utils] SessionStore: failed to parse ${this.filePath} (${detail}); ` + (backupPath !== null ? `preserved the corrupt file at ${backupPath}; ` : "could not preserve the corrupt file; ") + "starting with an empty store.");
+      this.sessions = /* @__PURE__ */ new Map();
+      this.mostRecentKey = null;
+    }
+  }
+  /**
+   * Move a corrupt store file to `<filePath>.corrupt` (or `.corrupt-<n>` if a
+   * previous backup exists) so a subsequent save cannot overwrite the only
+   * copy of the prior credentials. Best-effort: returns the backup path, or
+   * `null` if the rename failed.
+   */
+  preserveCorruptFile() {
+    try {
+      let candidate = `${this.filePath}.corrupt`;
+      for (let n = 1; existsSync(candidate) && n <= 100; n++) {
+        candidate = `${this.filePath}.corrupt-${n}`;
+      }
+      if (existsSync(candidate))
+        return null;
+      renameSync(this.filePath, candidate);
+      return candidate;
+    } catch {
+      return null;
+    }
+  }
+  /** Serialize the store to its on-disk JSON form (array, insertion order). */
+  serialize() {
+    return JSON.stringify(Array.from(this.sessions.values()), null, 2);
+  }
+  /** Parse on-disk JSON back into a keyed `Map`; empty map on invalid input. */
+  deserialize(body) {
+    const map2 = /* @__PURE__ */ new Map();
+    const arr = JSON.parse(body);
+    if (!Array.isArray(arr))
+      return map2;
+    for (const raw of arr) {
+      if (raw && typeof raw === "object") {
+        const s = raw;
+        const key = this.normalizeKey(this.keyOf(s));
+        map2.set(key, s);
+      }
+    }
+    return map2;
+  }
+  saveToDisk() {
+    const dir = dirname(this.filePath);
+    mkdirSync(dir, { recursive: true, mode: 448 });
+    if (existsSync(this.filePath)) {
+      try {
+        chmodSync(this.filePath, 384);
+      } catch {
+      }
+    }
+    writeFileSync(this.filePath, this.serialize(), { mode: 384 });
+    try {
+      chmodSync(this.filePath, 384);
+      chmodSync(dir, 448);
+    } catch {
+    }
+  }
+  /** Insert or replace a record, normalizing its key and marking it active. */
+  add(session) {
+    const key = this.normalizeKey(this.keyOf(session));
+    this.sessions.set(key, session);
+    this.mostRecentKey = key;
+    this.saveToDisk();
+  }
+  /** Look up by key; with no key, returns the active (most-recent) session. */
+  get(key) {
+    if (key !== void 0)
+      return this.sessions.get(this.normalizeKey(key)) ?? null;
+    if (this.mostRecentKey !== null)
+      return this.sessions.get(this.mostRecentKey) ?? null;
+    return null;
+  }
+  /** The most-recently-added session, or `null`. */
+  getActiveSession() {
+    return this.get();
+  }
+  /** All sessions in insertion order. */
+  list() {
+    return Array.from(this.sessions.values());
+  }
+  /** Remove a session; fixes up the active pointer. Returns whether it existed. */
+  remove(key) {
+    const normalized = this.normalizeKey(key);
+    const had = this.sessions.delete(normalized);
+    if (had) {
+      if (this.mostRecentKey === normalized) {
+        const keys = Array.from(this.sessions.keys());
+        this.mostRecentKey = keys[keys.length - 1] ?? null;
+      }
+      this.saveToDisk();
+    }
+    return had;
+  }
+  /** Clear in-memory state without touching disk. Test helper. */
+  resetForTest() {
+    this.sessions.clear();
+    this.mostRecentKey = null;
+  }
+};
+var TOKEN_REFRESH_SKEW_MS = 5 * 60 * 1e3;
+
+// src/session-store.ts
+var SESSION_KEY = "vibo";
+function openStore() {
+  return new SessionStore({
+    filePath: readEnvVar("VIBO_SESSION_FILE") ?? join(homedir(), ".vibo-mcp", "session.json"),
+    keyOf: (s) => typeof s.key === "string" && s.key ? s.key : SESSION_KEY,
+    normalizeKey: (k) => k
+    // fixed single key — no origin normalization
+  });
+}
+function loadSession() {
+  try {
+    const rec = openStore().get(SESSION_KEY);
+    if (rec && typeof rec.accessToken === "string" && rec.accessToken) {
+      return {
+        accessToken: rec.accessToken,
+        refreshToken: typeof rec.refreshToken === "string" ? rec.refreshToken : null
+      };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function saveSession(session) {
+  openStore().add({
+    key: SESSION_KEY,
+    accessToken: session.accessToken,
+    refreshToken: session.refreshToken ?? null
+  });
+}
+
+// src/client.ts
+var __dirname = dirname2(fileURLToPath(import.meta.url));
+await loadDotenvSafely({ path: join2(__dirname, "..", ".env"), override: false });
 var DEFAULT_API_URL = "https://api.vibodj.com/v2/graphql";
 var SERVICE = "Vibo";
 var SIGN_IN_HOST = "https://web.vibodj.com";
@@ -31148,6 +31326,7 @@ var ViboClient = class {
   apiUrl;
   email;
   password;
+  // Not readonly: cleared by setTokens() after a browser capture seeds a session.
   configError;
   accessToken;
   refreshTokenValue;
@@ -31166,18 +31345,41 @@ var ViboClient = class {
     this.accessToken = accessToken ?? null;
     this.refreshTokenValue = refreshToken ?? null;
     const haveLogin = Boolean(email3 && password);
-    const haveToken = Boolean(accessToken);
+    if (!this.accessToken && !haveLogin) {
+      const saved = loadSession();
+      if (saved) {
+        this.accessToken = saved.accessToken;
+        this.refreshTokenValue = saved.refreshToken;
+      }
+    }
+    const haveToken = Boolean(this.accessToken);
     if (!haveLogin && !haveToken) {
       this.configError = new McpToolError(
         "Vibo credentials are not configured.",
         {
-          hint: "Set VIBO_EMAIL and VIBO_PASSWORD (recommended), or paste a captured VIBO_ACCESS_TOKEN (+ VIBO_REFRESH_TOKEN) if your account uses Apple/Google/Facebook sign-in."
+          hint: "Set VIBO_EMAIL and VIBO_PASSWORD (recommended); paste a captured VIBO_ACCESS_TOKEN (+ VIBO_REFRESH_TOKEN); or run vibo_capture_session to grab the token from your signed-in web.vibodj.com browser tab (Apple/Google/Facebook accounts)."
         }
       );
     } else {
       this.configError = null;
     }
   }
+  /**
+   * Adopt a browser-captured token pair (from vibo_capture_session) for
+   * subsequent calls in this process and clear the config error so an account
+   * that started with no credentials becomes usable. Does NOT persist — the
+   * caller persists only after verifying the token authenticates (GET_ME).
+   */
+  setTokens(accessToken, refreshToken) {
+    this.accessToken = accessToken;
+    this.refreshTokenValue = refreshToken;
+    this.configError = null;
+  }
+  /** True when operating purely from a token (no email/password) — refreshed
+   *  tokens should be persisted so they survive a restart. */
+  get tokenOnlyMode() {
+    return !this.email || !this.password;
+  }
   /** Run a GraphQL operation, transparently authenticating + retrying once on token expiry. */
   async gql(query, variables = {}) {
     if (this.configError) throw this.configError;
@@ -31301,6 +31503,9 @@ var ViboClient = class {
             if (data.refreshToken?.accessToken) {
               this.accessToken = data.refreshToken.accessToken;
               this.refreshTokenValue = data.refreshToken.refreshToken;
+              if (this.tokenOnlyMode) {
+                saveSession({ accessToken: this.accessToken, refreshToken: this.refreshTokenValue });
+              }
               return this.accessToken;
             }
           }
@@ -32466,12 +32671,12 @@ function registerCollaborationTools(server) {
   server.registerTool(
     "vibo_list_event_users",
     {
-      description: "List the hosts and guests on an event.",
+      description: "List the hosts and guests on an event. With no usersType, returns both groups merged ({hosts, guests, hostsCount, guestsCount}) and `limit`/`skip` apply per group; with usersType, returns that one group's page.",
       annotations: toolAnnotations({ title: "List Vibo event users", readOnly: true }),
       inputSchema: {
         eventId: external_exports.string().describe("Event id."),
         usersType: external_exports.enum(["host", "guest"]).optional().describe("Filter to only hosts or only guests."),
-        limit: limitSchema,
+        limit: limitSchema.describe("Max items to return (default 20). Applies per group when usersType is omitted."),
         skip: skipSchema
       }
     },
@@ -32616,6 +32821,75 @@ function registerUploadTools(server) {
   );
 }
 
+// src/auth.ts
+var SERVER_NAME = "vibo-mcp";
+async function captureViboSession(deps = {}) {
+  let bootstrap = deps.bootstrap;
+  if (!bootstrap) {
+    try {
+      const mod = await import("@fetchproxy/bootstrap");
+      bootstrap = mod.bootstrap;
+    } catch (err) {
+      throw new McpToolError("Browser token capture is unavailable in this build.", {
+        hint: "Run vibo-mcp from npm (npx vibo-mcp) \u2014 the packaged .mcpb omits @fetchproxy/bootstrap. Or set VIBO_ACCESS_TOKEN instead.",
+        cause: err
+      });
+    }
+  }
+  let session;
+  try {
+    session = await bootstrap({
+      serverName: SERVER_NAME,
+      version: VERSION,
+      domains: ["vibodj.com"],
+      storageSubdomain: "web",
+      // tokens live on web.vibodj.com
+      declare: { cookies: [], localStorage: ["x-token", "x-refresh-token"], sessionStorage: [], captureHeaders: [] },
+      onPairCode: (code) => process.stderr.write(`[vibo-mcp] fetchproxy pair code: ${code}
+`),
+      onWaiting: (hint) => process.stderr.write(`[vibo-mcp] ${hint}
+`)
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new McpToolError(`Vibo browser token capture failed: ${msg}`, {
+      hint: "Install the fetchproxy browser extension, sign into https://web.vibodj.com, approve the pair code, then retry.",
+      cause: err
+    });
+  }
+  const accessToken = session.localStorage?.["x-token"];
+  const refreshToken = session.localStorage?.["x-refresh-token"] ?? null;
+  if (!accessToken) {
+    throw new McpToolError("No Vibo token found in the signed-in browser tab.", {
+      hint: "Make sure you are signed into https://web.vibodj.com in the browser with the fetchproxy extension, then retry."
+    });
+  }
+  return { accessToken, refreshToken };
+}
+
+// src/tools/session.ts
+function registerSessionTools(server) {
+  server.registerTool(
+    "vibo_capture_session",
+    {
+      description: "Capture your Vibo login from a signed-in web.vibodj.com browser tab via the fetchproxy bridge \u2014 for accounts that sign in with Apple/Google/Facebook (no password). Requires the fetchproxy browser extension installed and you signed into https://web.vibodj.com; approve the pair code shown on first use. The token is saved locally and reused on future calls.",
+      annotations: toolAnnotations({ title: "Capture Vibo session (SSO)", readOnly: false })
+    },
+    async () => {
+      const { accessToken, refreshToken } = await captureViboSession();
+      client.setTokens(accessToken, refreshToken);
+      const data = await client.gql(GET_ME);
+      saveSession({ accessToken, refreshToken });
+      return textResult({
+        captured: true,
+        hasRefreshToken: Boolean(refreshToken),
+        userId: data.me._id,
+        email: data.me.email
+      });
+    }
+  );
+}
+
 // src/index.ts
 await runMcp({
   name: "vibo-mcp",
@@ -32635,6 +32909,7 @@ await runMcp({
     registerImportTools,
     registerCollaborationTools,
     registerSectionEditTools,
-    registerUploadTools
+    registerUploadTools,
+    registerSessionTools
   ]
 });

package/dist/client.js

@@ -1,6 +1,7 @@
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
 import { loadDotenvSafely, readEnvVar, McpToolError, SessionNotAuthenticatedError, truncateErrorMessage, } from '@chrischall/mcp-utils';
+import { loadSession, saveSession } from './session-store.js';
 // Load .env for local dev; silently skip if dotenv is unavailable (e.g. the
 // mcpb bundle, which externalizes dotenv). `override: false` means a
 // host-provided env var always wins over .env.
@@ -50,6 +51,7 @@ export class ViboClient {
     apiUrl;
     email;
     password;
+    // Not readonly: cleared by setTokens() after a browser capture seeds a session.
     configError;
     accessToken;
     refreshTokenValue;
@@ -68,17 +70,45 @@ export class ViboClient {
         this.accessToken = accessToken ?? null;
         this.refreshTokenValue = refreshToken ?? null;
         const haveLogin = Boolean(email && password);
-        const haveToken = Boolean(accessToken);
+        // Fall back to a previously browser-captured session (SSO accounts) ONLY
+        // when there's no env token AND no email/password. Email/password is the
+        // documented preferred path and must win over a (possibly stale) saved
+        // session — otherwise an old session.json would silently shadow it.
+        if (!this.accessToken && !haveLogin) {
+            const saved = loadSession();
+            if (saved) {
+                this.accessToken = saved.accessToken;
+                this.refreshTokenValue = saved.refreshToken;
+            }
+        }
+        const haveToken = Boolean(this.accessToken);
         if (!haveLogin && !haveToken) {
             this.configError = new McpToolError('Vibo credentials are not configured.', {
-                hint: 'Set VIBO_EMAIL and VIBO_PASSWORD (recommended), or paste a captured ' +
-                    'VIBO_ACCESS_TOKEN (+ VIBO_REFRESH_TOKEN) if your account uses Apple/Google/Facebook sign-in.',
+                hint: 'Set VIBO_EMAIL and VIBO_PASSWORD (recommended); paste a captured ' +
+                    'VIBO_ACCESS_TOKEN (+ VIBO_REFRESH_TOKEN); or run vibo_capture_session to grab the ' +
+                    'token from your signed-in web.vibodj.com browser tab (Apple/Google/Facebook accounts).',
             });
         }
         else {
             this.configError = null;
         }
     }
+    /**
+     * Adopt a browser-captured token pair (from vibo_capture_session) for
+     * subsequent calls in this process and clear the config error so an account
+     * that started with no credentials becomes usable. Does NOT persist — the
+     * caller persists only after verifying the token authenticates (GET_ME).
+     */
+    setTokens(accessToken, refreshToken) {
+        this.accessToken = accessToken;
+        this.refreshTokenValue = refreshToken;
+        this.configError = null;
+    }
+    /** True when operating purely from a token (no email/password) — refreshed
+     *  tokens should be persisted so they survive a restart. */
+    get tokenOnlyMode() {
+        return !this.email || !this.password;
+    }
     /** Run a GraphQL operation, transparently authenticating + retrying once on token expiry. */
     async gql(query, variables = {}) {
         if (this.configError)
@@ -205,6 +235,11 @@ export class ViboClient {
                         if (data.refreshToken?.accessToken) {
                             this.accessToken = data.refreshToken.accessToken;
                             this.refreshTokenValue = data.refreshToken.refreshToken;
+                            // Persist the rotated pair so a captured/pasted session survives
+                            // a restart (no email/password to re-login with).
+                            if (this.tokenOnlyMode) {
+                                saveSession({ accessToken: this.accessToken, refreshToken: this.refreshTokenValue });
+                            }
                             return this.accessToken;
                         }
                     }

package/dist/index.js

@@ -15,6 +15,7 @@ import { registerImportTools } from './tools/imports.js';
 import { registerCollaborationTools } from './tools/collaboration.js';
 import { registerSectionEditTools } from './tools/section-edit.js';
 import { registerUploadTools } from './tools/uploads.js';
+import { registerSessionTools } from './tools/session.js';
 // The ViboClient is a module-level singleton (constructed in client.ts and
 // imported by each tool module) that defers its config error to the first
 // request. That preserves the deferred-config-error pattern: the server boots
@@ -39,5 +40,6 @@ await runMcp({
         registerCollaborationTools,
         registerSectionEditTools,
         registerUploadTools,
+        registerSessionTools,
     ],
 });

package/dist/session-store.js

@@ -0,0 +1,47 @@
+import { homedir } from 'os';
+import { join } from 'path';
+import { readEnvVar } from '@chrischall/mcp-utils';
+import { SessionStore } from '@chrischall/mcp-utils/session';
+const SESSION_KEY = 'vibo';
+// Constructed per call (it re-reads disk) so VIBO_SESSION_FILE is honored
+// dynamically, matching the previous read-env-on-every-call behaviour.
+function openStore() {
+    return new SessionStore({
+        filePath: readEnvVar('VIBO_SESSION_FILE') ?? join(homedir(), '.vibo-mcp', 'session.json'),
+        keyOf: (s) => (typeof s.key === 'string' && s.key ? s.key : SESSION_KEY),
+        normalizeKey: (k) => k, // fixed single key — no origin normalization
+    });
+}
+/** Load a previously-captured session, or null if none / unreadable. */
+export function loadSession() {
+    try {
+        const rec = openStore().get(SESSION_KEY);
+        if (rec && typeof rec.accessToken === 'string' && rec.accessToken) {
+            return {
+                accessToken: rec.accessToken,
+                refreshToken: typeof rec.refreshToken === 'string' ? rec.refreshToken : null,
+            };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Persist a captured/refreshed token pair (0600 file in a 0700 dir). */
+export function saveSession(session) {
+    openStore().add({
+        key: SESSION_KEY,
+        accessToken: session.accessToken,
+        refreshToken: session.refreshToken ?? null,
+    });
+}
+/** Remove any persisted session. */
+export function clearSession() {
+    try {
+        openStore().remove(SESSION_KEY);
+    }
+    catch {
+        // best-effort
+    }
+}

package/dist/tools/collaboration.js

@@ -5,12 +5,12 @@ import { LIST_EVENT_USERS, INVITE_USERS, CHANGE_USER_ROLE, REMOVE_USER } from '.
 import { limitSchema, skipSchema, pagination, previewResult } from './shared.js';
 export function registerCollaborationTools(server) {
     server.registerTool('vibo_list_event_users', {
-        description: 'List the hosts and guests on an event.',
+        description: "List the hosts and guests on an event. With no usersType, returns both groups merged ({hosts, guests, hostsCount, guestsCount}) and `limit`/`skip` apply per group; with usersType, returns that one group's page.",
         annotations: toolAnnotations({ title: 'List Vibo event users', readOnly: true }),
         inputSchema: {
             eventId: z.string().describe('Event id.'),
             usersType: z.enum(['host', 'guest']).optional().describe('Filter to only hosts or only guests.'),
-            limit: limitSchema,
+            limit: limitSchema.describe('Max items to return (default 20). Applies per group when usersType is omitted.'),
             skip: skipSchema,
         },
     }, async ({ eventId, usersType, limit, skip }) => {

package/dist/tools/session.js

@@ -0,0 +1,24 @@
+import { textResult, toolAnnotations } from '@chrischall/mcp-utils';
+import { client } from '../client.js';
+import { captureViboSession } from '../auth.js';
+import { saveSession } from '../session-store.js';
+import { GET_ME } from '../gql.js';
+export function registerSessionTools(server) {
+    server.registerTool('vibo_capture_session', {
+        description: "Capture your Vibo login from a signed-in web.vibodj.com browser tab via the fetchproxy bridge — for accounts that sign in with Apple/Google/Facebook (no password). Requires the fetchproxy browser extension installed and you signed into https://web.vibodj.com; approve the pair code shown on first use. The token is saved locally and reused on future calls.",
+        annotations: toolAnnotations({ title: 'Capture Vibo session (SSO)', readOnly: false }),
+    }, async () => {
+        const { accessToken, refreshToken } = await captureViboSession();
+        client.setTokens(accessToken, refreshToken);
+        // Confirm the captured token actually authenticates BEFORE persisting it,
+        // so a stale snapshot never lands in session.json.
+        const data = await client.gql(GET_ME);
+        saveSession({ accessToken, refreshToken });
+        return textResult({
+            captured: true,
+            hasRefreshToken: Boolean(refreshToken),
+            userId: data.me._id,
+            email: data.me.email,
+        });
+    });
+}

package/dist/version.js

@@ -2,4 +2,4 @@
 // literal on the line carrying the release marker; every manifest and the MCP
 // server banner import VERSION from here, so there is exactly one place to keep
 // in sync (and one release-please extra-files entry).
-export const VERSION = '1.2.0'; // x-release-please-version
+export const VERSION = '1.3.1'; // x-release-please-version

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "vibo-mcp",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "mcpName": "io.github.chrischall/vibo-mcp",
-  "description": "Vibo (vibodj.com) MCP server for Claude — host/couple event music planning. Developed and maintained by AI (Claude Code).",
+  "description": "Vibo (vibodj.com) MCP server for Claude — host/couple event music planning & management. Developed and maintained by AI (Claude Code).",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
   "repository": {
     "type": "git",
@@ -37,20 +37,21 @@
   ],
   "scripts": {
     "build": "tsc && npm run bundle",
-    "bundle": "esbuild src/index.ts --bundle --platform=node --format=esm --external:dotenv --outfile=dist/bundle.js",
+    "bundle": "esbuild src/index.ts --bundle --platform=node --format=esm --external:dotenv --external:@fetchproxy/bootstrap --outfile=dist/bundle.js",
     "dev": "node dist/index.js",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.10.4",
+    "@chrischall/mcp-utils": "^0.12.0",
+    "@fetchproxy/bootstrap": "^1.3.4",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.0",
     "zod": "^4.4.2"
   },
   "devDependencies": {
-    "@types/node": "^25.5.2",
+    "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^4.1.2",
     "esbuild": "^0.28.0",
     "typescript": "^6.0.2",

package/server.json

@@ -1,17 +1,17 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.chrischall/vibo-mcp",
-  "description": "Vibo (vibodj.com) MCP — plan event music: events, timeline, song requests, playlist export",
+  "description": "Vibo (vibodj.com) MCP — plan & manage event music: timeline, songs, ideas, questions, guests",
   "repository": {
     "url": "https://github.com/chrischall/vibo-mcp",
     "source": "github"
   },
-  "version": "1.2.0",
+  "version": "1.3.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "vibo-mcp",
-      "version": "1.2.0",
+      "version": "1.3.1",
       "transport": {
         "type": "stdio"
       },