vibo-mcp 2.1.0 → 2.2.1

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Vibo (vibodj.com) — plan & manage event music, song requests, ideas, guests, and playlists via natural language",
-    "version": "2.1.0"
+    "version": "2.2.1"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Vibo",
       "source": "./",
       "description": "MCP server for Vibo — browse & manage events, timeline, songs, the DJ song ideas/questions, guests, and exports to Spotify/Apple Music",
-      "version": "2.1.0",
+      "version": "2.2.1",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "vibo-mcp",
   "displayName": "Vibo",
-  "version": "2.1.0",
+  "version": "2.2.1",
   "description": "MCP server for Vibo (vibodj.com) — plan & manage event music, song requests, ideas, guests, and playlists via natural language",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -5,6 +5,31 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// node_modules/@chrischall/mcp-utils/dist/cancel/index.js
+import { AsyncLocalStorage } from "node:async_hooks";
+var storage = new AsyncLocalStorage();
+function withCallSignal(signal, fn, request) {
+  return signal ? storage.run({ signal, ...request ? { request } : {} }, fn) : fn();
+}
+function currentCallSignal() {
+  return storage.getStore()?.signal;
+}
+function withAmbientCancellation(own2) {
+  const ambient = currentCallSignal();
+  if (!ambient)
+    return own2;
+  if (!own2)
+    return ambient;
+  return AbortSignal.any([own2, ambient]);
+}
+
+// node_modules/@chrischall/mcp-utils/dist/caller/index.js
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var storage2 = new AsyncLocalStorage2();
+function withCallerCapabilities(capabilities, fn) {
+  return capabilities ? storage2.run(capabilities, fn) : fn();
+}
+
 // node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create = Object.create;
 var __defProp2 = Object.defineProperty;
@@ -34474,17 +34499,73 @@ Hint: ${err.hint}`);
   }
   throw err;
 }
+function mcpRequestFrom(args) {
+  const ctx = args.at(-1);
+  if (typeof ctx !== "object" || ctx === null)
+    return void 0;
+  const req = ctx.mcpReq;
+  if (typeof req !== "object" || req === null)
+    return void 0;
+  return typeof req.notify === "function" ? req : void 0;
+}
+function callSignalFrom(args) {
+  const ctx = args.at(-1);
+  if (typeof ctx !== "object" || ctx === null)
+    return void 0;
+  const req = ctx.mcpReq;
+  if (typeof req !== "object" || req === null)
+    return void 0;
+  const signal = req.signal;
+  return signal instanceof AbortSignal ? signal : void 0;
+}
+function declaredCapabilitiesFrom(server) {
+  const inner = server.server;
+  if (typeof inner !== "object" || inner === null)
+    return void 0;
+  const read = inner.getClientCapabilities;
+  if (typeof read !== "function")
+    return void 0;
+  try {
+    const declared = read.call(inner);
+    return typeof declared === "object" && declared !== null ? declared : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function surfaceToolHints(server) {
   const register2 = server.registerTool.bind(server);
-  server.registerTool = (name, config2, cb) => register2(name, config2, (...args) => {
-    let result;
-    try {
-      result = cb(...args);
-    } catch (err) {
-      return hintResultOrRethrow(err);
-    }
-    return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
-  });
+  server.registerTool = (name, config2, cb) => register2(name, config2, (...args) => (
+    // THE CALLER'S CANCELLATION, made ambient for the whole handler
+    // (`cancel/index.ts`). The SDK delivers it and the fleet ignored it:
+    // measured against @modelcontextprotocol/server 2.0.0, a cancelled
+    // call aborts `ctx.mcpReq.signal` with the caller's reason and the
+    // handler runs to completion regardless — so the HTTP request stays
+    // in flight, the child keeps burning metered CPU, and the upstream
+    // keeps being hit for somebody who has gone. claude.ai sent 101
+    // cancellations in the week to 2026-09-20.
+    //
+    // Here because this is the one wrapper every tool already passes
+    // through: threading the signal by hand would mean editing several
+    // hundred handlers and missing exactly the ones nobody edits.
+    withCallSignal(callSignalFrom(args), () => (
+      // WHAT THE CALLER CAN DO, made ambient for the same reason and in
+      // the same place (`caller/index.ts`). Only the 2025-era half needs
+      // the wrapper — a 2026-07-28 request answers for itself off its own
+      // envelope — but a guarded tool that cannot tell whether the caller
+      // can be shown a prompt returns one the SDK then refuses to deliver,
+      // and that refusal reaches the caller as an unexplained protocol
+      // error it had no chance to catch.
+      withCallerCapabilities(declaredCapabilitiesFrom(server), () => {
+        let result;
+        try {
+          result = cb(...args);
+        } catch (err) {
+          return hintResultOrRethrow(err);
+        }
+        return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
+      })
+    ), mcpRequestFrom(args))
+  ));
 }
 async function createMcpServer(opts) {
   const server = new McpServer({ name: opts.name, version: opts.version }, { supportedProtocolVersions: [...SERVER_PROTOCOL_VERSIONS] });
@@ -34597,12 +34678,13 @@ function toolAnnotations(opts = {}) {
     ...opts.title !== void 0 ? { title: opts.title } : {},
     readOnlyHint: opts.readOnly ?? true,
     ...opts.idempotent !== void 0 ? { idempotentHint: opts.idempotent } : {},
+    ...opts.destructive !== void 0 ? { destructiveHint: opts.destructive } : {},
     ...opts.openWorld !== void 0 ? { openWorldHint: opts.openWorld } : {}
   };
 }
 
 // src/version.ts
-var VERSION = "2.1.0";
+var VERSION = "2.2.1";
 
 // src/client.ts
 import { dirname as dirname2, join as join3 } from "path";
@@ -34807,6 +34889,9 @@ var REFRESH = `
   }
 `;
 var AUTH_ERROR_CODES = /* @__PURE__ */ new Set(["UNAUTHORIZED", "UNAUTHENTICATED", "FORBIDDEN"]);
+function requestSignal() {
+  return withAmbientCancellation(AbortSignal.timeout(REQUEST_TIMEOUT_MS));
+}
 var ViboClient = class {
   apiUrl;
   email;
@@ -34931,7 +35016,7 @@ var ViboClient = class {
         headers,
         // NB: no content-type — fetch sets the multipart boundary
         body: form,
-        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+        signal: requestSignal()
       });
     } catch (err) {
       const reason = err instanceof Error && err.name === "TimeoutError" ? "timed out" : "failed";
@@ -35021,7 +35106,7 @@ var ViboClient = class {
         method: "POST",
         headers,
         body: JSON.stringify({ query, variables }),
-        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+        signal: requestSignal()
       });
     } catch (err) {
       const reason = err instanceof Error && err.name === "TimeoutError" ? "timed out" : "failed";
@@ -35478,7 +35563,7 @@ function registerEventTools(server, client2) {
     "vibo_join_event",
     {
       description: "Join an event you were invited to, via its share link or hash (e.g. a vibodj.app.link/... URL someone sent you). Returns the joined event's id. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Join Vibo event", readOnly: false }),
+      annotations: toolAnnotations({ title: "Join Vibo event", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         link: external_exports.string().describe("The full event share URL (vibodj.app.link/... or web.vibodj.com/...) or the bare join hash."),
         confirm: schemaConfirm
@@ -35503,7 +35588,7 @@ function registerEventTools(server, client2) {
     "vibo_leave_event",
     {
       description: "Leave an event you previously joined. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Leave Vibo event", readOnly: false }),
+      annotations: toolAnnotations({ title: "Leave Vibo event", readOnly: false, destructive: true }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id to leave."),
         confirm: schemaConfirm
@@ -35519,7 +35604,7 @@ function registerEventTools(server, client2) {
     "vibo_create_event_contact",
     {
       description: "Add a contact (host or guest) to an event with their name/email/phone. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Add Vibo event contact", readOnly: false }),
+      annotations: toolAnnotations({ title: "Add Vibo event contact", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         role: external_exports.enum(["host", "guest"]).describe("The contact's role in the event."),
@@ -35763,7 +35848,7 @@ function registerSongTools(server, client2) {
     "vibo_add_song_to_section",
     {
       description: "Add a song to a section. Pass a song from vibo_search_songs (songUrl is required; include viboSongId/title/artist when known). Before adding, check that result's `quality.confidence`: adding a `likely-not-original` result puts a cover, karaoke track or junk-metadata re-upload in front of a live DJ. If nothing looks original, report the closest matches back rather than adding a best guess. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Add song to Vibo section", readOnly: false }),
+      annotations: toolAnnotations({ title: "Add song to Vibo section", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         sectionId: external_exports.string().describe("Section id to add the song to."),
@@ -35793,7 +35878,7 @@ function registerSongTools(server, client2) {
     "vibo_toggle_song_like",
     {
       description: "Like or unlike a song in a section. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Like/unlike Vibo song", readOnly: false }),
+      annotations: toolAnnotations({ title: "Like/unlike Vibo song", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         sectionId: external_exports.string().describe("Section id."),
@@ -35864,7 +35949,7 @@ function registerPlaylistTools(server, client2) {
     "vibo_export_event_to_spotify",
     {
       description: "Export an event's song selections to a new Spotify playlist (Spotify must be connected). Returns the playlist URL plus how many tracks exported / failed. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Export event to Spotify", readOnly: false }),
+      annotations: toolAnnotations({ title: "Export event to Spotify", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         sectionIds: external_exports.array(external_exports.string()).min(1).describe("Section ids to include (from vibo_list_sections)."),
@@ -35886,7 +35971,7 @@ function registerPlaylistTools(server, client2) {
     "vibo_export_event_to_apple_music",
     {
       description: "Export an event's song selections to a new Apple Music playlist (Apple Music must be connected). Returns the playlist URL plus how many tracks exported / failed. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Export event to Apple Music", readOnly: false }),
+      annotations: toolAnnotations({ title: "Export event to Apple Music", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         sectionIds: external_exports.array(external_exports.string()).min(1).describe("Section ids to include (from vibo_list_sections)."),
@@ -35941,7 +36026,7 @@ function registerNotificationTools(server, client2) {
     "vibo_mark_notifications_read",
     {
       description: "Mark notifications as read \u2014 pass specific notificationIds, or readAll:true to clear everything. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Mark notifications read", readOnly: false }),
+      annotations: toolAnnotations({ title: "Mark notifications read", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         notificationIds: external_exports.array(external_exports.string()).optional().describe("Specific notification ids to mark read."),
         readAll: external_exports.boolean().optional().describe("Mark every notification as read."),
@@ -36026,7 +36111,7 @@ function registerQuestionTools(server, client2, resolveUpload = nodeUploadResolv
     "vibo_answer_question",
     {
       description: "Answer a section planning question. Provide the field matching the question's type: `text` for a text question, `selectedOptions` (array of option _ids from vibo_list_section_questions) for radio/checkbox/select, or `link` (array of URLs) for a link question. Use `otherOptionTitle` with the question's \"other\" option. For photo/file questions, pass local paths (`imagePaths`/`filePaths`) when the server can read your disk, or inline base64 bytes (`images`/`files`) otherwise. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Answer Vibo question", readOnly: false }),
+      annotations: toolAnnotations({ title: "Answer Vibo question", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         sectionId: external_exports.string().describe("Section id."),
@@ -36110,7 +36195,7 @@ function registerSongManagementTools(server, client2) {
     "vibo_remove_song_from_section",
     {
       description: "Remove one or more songs from a section. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Remove songs from Vibo section", readOnly: false }),
+      annotations: toolAnnotations({ title: "Remove songs from Vibo section", readOnly: false, destructive: true }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         sectionId: external_exports.string().describe("Section id."),
@@ -36129,7 +36214,7 @@ function registerSongManagementTools(server, client2) {
     "vibo_update_song",
     {
       description: "Update songs in a section: mark must-play, flag as do-not-play, and/or set a comment. Provide at least one field. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Update Vibo section songs", readOnly: false }),
+      annotations: toolAnnotations({ title: "Update Vibo section songs", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         sectionId: external_exports.string().describe("Section id."),
@@ -36160,7 +36245,7 @@ function registerSongManagementTools(server, client2) {
     "vibo_move_song",
     {
       description: "Move songs from one section to another. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Move Vibo section songs", readOnly: false }),
+      annotations: toolAnnotations({ title: "Move Vibo section songs", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         sourceSectionId: external_exports.string().describe("Section id the songs are currently in."),
@@ -36180,7 +36265,7 @@ function registerSongManagementTools(server, client2) {
     "vibo_reorder_songs",
     {
       description: "Reorder songs within a section. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Reorder Vibo section songs", readOnly: false }),
+      annotations: toolAnnotations({ title: "Reorder Vibo section songs", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         sectionId: external_exports.string().describe("Section id."),
@@ -36204,7 +36289,7 @@ function registerCommentTools(server, client2) {
     "vibo_comment_on_song",
     {
       description: "Leave a comment / note for the DJ on a specific song. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Comment on Vibo song", readOnly: false }),
+      annotations: toolAnnotations({ title: "Comment on Vibo song", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         sectionId: external_exports.string().describe("Section id."),
@@ -36224,7 +36309,7 @@ function registerCommentTools(server, client2) {
     "vibo_delete_song_comment",
     {
       description: "Delete a comment on a song. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Delete Vibo song comment", readOnly: false }),
+      annotations: toolAnnotations({ title: "Delete Vibo song comment", readOnly: false, destructive: true }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         sectionId: external_exports.string().describe("Section id."),
@@ -36244,7 +36329,7 @@ function registerCommentTools(server, client2) {
     "vibo_comment_on_section",
     {
       description: "Leave a comment on a timeline section. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Comment on Vibo section", readOnly: false }),
+      annotations: toolAnnotations({ title: "Comment on Vibo section", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         sectionId: external_exports.string().describe("Section id (from vibo_list_sections)."),
@@ -36263,7 +36348,7 @@ function registerCommentTools(server, client2) {
     "vibo_delete_section_comment",
     {
       description: "Delete a comment on a timeline section. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Delete Vibo section comment", readOnly: false }),
+      annotations: toolAnnotations({ title: "Delete Vibo section comment", readOnly: false, destructive: true }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         sectionId: external_exports.string().describe("Section id (from vibo_list_sections)."),
@@ -36335,7 +36420,7 @@ function registerImportTools(server, client2) {
     "vibo_import_playlist_to_section",
     {
       description: "Import selected tracks from a connected Spotify/Apple Music playlist into a section. Returns counts of added/existing/ignored. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Import playlist to section", readOnly: false }),
+      annotations: toolAnnotations({ title: "Import playlist to section", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         sectionId: external_exports.string().describe("Section id (from vibo_list_sections)."),
@@ -36406,7 +36491,7 @@ function registerCollaborationTools(server, client2) {
     "vibo_invite_users",
     {
       description: "Invite people to an event by email (as host or guest). Confirm-gated.",
-      annotations: toolAnnotations({ title: "Invite Vibo event users", readOnly: false }),
+      annotations: toolAnnotations({ title: "Invite Vibo event users", readOnly: false, destructive: true }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         type: external_exports.enum(["host", "guest"]).describe("Invite as host or guest."),
@@ -36426,7 +36511,7 @@ function registerCollaborationTools(server, client2) {
     "vibo_change_user_role",
     {
       description: "Change an event member's role between host and guest. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Change Vibo user role", readOnly: false }),
+      annotations: toolAnnotations({ title: "Change Vibo user role", readOnly: false, destructive: true }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         userId: external_exports.string().describe("Id of the member to update."),
@@ -36445,7 +36530,7 @@ function registerCollaborationTools(server, client2) {
     "vibo_remove_user",
     {
       description: "Remove a member from an event. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Remove Vibo event user", readOnly: false }),
+      annotations: toolAnnotations({ title: "Remove Vibo event user", readOnly: false, destructive: true }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         userId: external_exports.string().describe("Id of the member to remove."),
@@ -36467,7 +36552,7 @@ function registerSectionEditTools(server, client2) {
     "vibo_update_section",
     {
       description: "Edit a timeline section's name, time, note, or description. Subject to the section's host-edit permissions. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Update Vibo section", readOnly: false }),
+      annotations: toolAnnotations({ title: "Update Vibo section", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         eventId: external_exports.string(),
         sectionId: external_exports.string(),
@@ -36503,7 +36588,7 @@ function registerUploadTools(server, client2, resolveUpload = nodeUploadResolver
     "vibo_set_profile_photo",
     {
       description: "Set your Vibo profile photo from an image. Pass a local file `path` if the server shares your filesystem; otherwise pass the image bytes as base64 `fileData`. Returns the uploaded image URL. Confirm-gated.",
-      annotations: toolAnnotations({ title: "Set Vibo profile photo", readOnly: false }),
+      annotations: toolAnnotations({ title: "Set Vibo profile photo", readOnly: false, destructive: false }),
       inputSchema: external_exports.object({
         path: external_exports.string().optional().describe("Absolute path to a local image file (jpg/png). Local/stdio server only."),
         fileData: external_exports.string().optional().describe("Base64-encoded image bytes (a `data:` URL prefix is allowed). Use this when the server cannot read your filesystem."),
@@ -36581,7 +36666,7 @@ function registerSessionTools(server, client2) {
     "vibo_capture_session",
     {
       description: "Capture your Vibo login from a signed-in web.vibodj.com browser tab via the fetchproxy bridge \u2014 for accounts that sign in with Apple/Google/Facebook (no password). Requires the fetchproxy browser extension installed and you signed into https://web.vibodj.com; approve the pair code shown on first use. The token is saved locally and reused on future calls.",
-      annotations: toolAnnotations({ title: "Capture Vibo session (SSO)", readOnly: false })
+      annotations: toolAnnotations({ title: "Capture Vibo session (SSO)", readOnly: false, destructive: false })
     },
     async () => {
       const { accessToken, refreshToken } = await captureViboSession();

package/dist/client.js

@@ -1,6 +1,6 @@
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
-import { loadDotenvSafely, readEnvVar, McpToolError, SessionNotAuthenticatedError, truncateErrorMessage, } from '@chrischall/mcp-utils';
+import { loadDotenvSafely, readEnvVar, McpToolError, SessionNotAuthenticatedError, truncateErrorMessage, withAmbientCancellation, } from '@chrischall/mcp-utils';
 import { loadSession, saveSession } from './session-store.js';
 // Load .env for local dev; silently skip if dotenv is unavailable (e.g. the
 // mcpb bundle, which externalizes dotenv). `override: false` means a
@@ -40,6 +40,25 @@ const REFRESH = `
 // Error codes Vibo (and conventional GraphQL servers) use for an expired /
 // missing session — these should trigger a token refresh + replay.
 const AUTH_ERROR_CODES = new Set(['UNAUTHORIZED', 'UNAUTHENTICATED', 'FORBIDDEN']);
+/**
+ * The signal every Vibo request is made with: our timeout, and the caller's
+ * cancellation if there is one (mcp-utils `cancel`).
+ *
+ * Until this, only the timeout could stop a request — a cancelled tool call
+ * held it open for the full budget while the child burned the CPU mcp-host
+ * meters it on. Measured on that fleet: claude.ai sent 101 cancellations in
+ * the week to 2026-09-20.
+ *
+ * ONE definition for both request paths, which is not tidiness: the two are
+ * the multipart upload and the plain query, they had the same seven lines
+ * copied between them, and the next person to add a third path is the one
+ * this saves. The `TimeoutError` checks at both call sites still name a real
+ * timeout — an abort from the caller arrives as `AbortError` and falls
+ * through to 'failed'.
+ */
+function requestSignal() {
+    return withAmbientCancellation(AbortSignal.timeout(REQUEST_TIMEOUT_MS));
+}
 export class ViboClient {
     apiUrl;
     email;
@@ -172,7 +191,7 @@ export class ViboClient {
                 method: 'POST',
                 headers, // NB: no content-type — fetch sets the multipart boundary
                 body: form,
-                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                signal: requestSignal(),
             });
         }
         catch (err) {
@@ -265,7 +284,7 @@ export class ViboClient {
                 method: 'POST',
                 headers,
                 body: JSON.stringify({ query, variables }),
-                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                signal: requestSignal(),
             });
         }
         catch (err) {

package/dist/tools/collaboration.js

@@ -42,7 +42,7 @@ export function registerCollaborationTools(server, client) {
     });
     server.registerTool('vibo_invite_users', {
         description: 'Invite people to an event by email (as host or guest). Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Invite Vibo event users', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Invite Vibo event users', readOnly: false, destructive: true }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             type: z.enum(['host', 'guest']).describe('Invite as host or guest.'),
@@ -59,7 +59,7 @@ export function registerCollaborationTools(server, client) {
     });
     server.registerTool('vibo_change_user_role', {
         description: "Change an event member's role between host and guest. Confirm-gated.",
-        annotations: toolAnnotations({ title: 'Change Vibo user role', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Change Vibo user role', readOnly: false, destructive: true }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             userId: z.string().describe('Id of the member to update.'),
@@ -75,7 +75,7 @@ export function registerCollaborationTools(server, client) {
     });
     server.registerTool('vibo_remove_user', {
         description: 'Remove a member from an event. Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Remove Vibo event user', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Remove Vibo event user', readOnly: false, destructive: true }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             userId: z.string().describe('Id of the member to remove.'),

package/dist/tools/comments.js

@@ -5,7 +5,7 @@ import { previewResult } from './shared.js';
 export function registerCommentTools(server, client) {
     server.registerTool('vibo_comment_on_song', {
         description: 'Leave a comment / note for the DJ on a specific song. Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Comment on Vibo song', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Comment on Vibo song', readOnly: false, destructive: false }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             sectionId: z.string().describe('Section id.'),
@@ -22,7 +22,7 @@ export function registerCommentTools(server, client) {
     });
     server.registerTool('vibo_delete_song_comment', {
         description: 'Delete a comment on a song. Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Delete Vibo song comment', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Delete Vibo song comment', readOnly: false, destructive: true }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             sectionId: z.string().describe('Section id.'),
@@ -39,7 +39,7 @@ export function registerCommentTools(server, client) {
     });
     server.registerTool('vibo_comment_on_section', {
         description: 'Leave a comment on a timeline section. Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Comment on Vibo section', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Comment on Vibo section', readOnly: false, destructive: false }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             sectionId: z.string().describe('Section id (from vibo_list_sections).'),
@@ -55,7 +55,7 @@ export function registerCommentTools(server, client) {
     });
     server.registerTool('vibo_delete_section_comment', {
         description: 'Delete a comment on a timeline section. Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Delete Vibo section comment', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Delete Vibo section comment', readOnly: false, destructive: true }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             sectionId: z.string().describe('Section id (from vibo_list_sections).'),

package/dist/tools/events.js

@@ -33,7 +33,7 @@ export function registerEventTools(server, client) {
     });
     server.registerTool('vibo_join_event', {
         description: "Join an event you were invited to, via its share link or hash (e.g. a vibodj.app.link/... URL someone sent you). Returns the joined event's id. Confirm-gated.",
-        annotations: toolAnnotations({ title: 'Join Vibo event', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Join Vibo event', readOnly: false, destructive: false }),
         inputSchema: z.object({
             link: z
                 .string()
@@ -56,7 +56,7 @@ export function registerEventTools(server, client) {
     });
     server.registerTool('vibo_leave_event', {
         description: 'Leave an event you previously joined. Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Leave Vibo event', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Leave Vibo event', readOnly: false, destructive: true }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id to leave.'),
             confirm: schemaConfirm,
@@ -69,7 +69,7 @@ export function registerEventTools(server, client) {
     });
     server.registerTool('vibo_create_event_contact', {
         description: 'Add a contact (host or guest) to an event with their name/email/phone. Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Add Vibo event contact', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Add Vibo event contact', readOnly: false, destructive: false }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             role: z.enum(['host', 'guest']).describe("The contact's role in the event."),

package/dist/tools/imports.js

@@ -5,7 +5,7 @@ import { previewResult } from './shared.js';
 export function registerImportTools(server, client) {
     server.registerTool('vibo_import_playlist_to_section', {
         description: 'Import selected tracks from a connected Spotify/Apple Music playlist into a section. Returns counts of added/existing/ignored. Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Import playlist to section', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Import playlist to section', readOnly: false, destructive: false }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             sectionId: z.string().describe('Section id (from vibo_list_sections).'),

package/dist/tools/notifications.js

@@ -27,7 +27,7 @@ export function registerNotificationTools(server, client) {
     });
     server.registerTool('vibo_mark_notifications_read', {
         description: 'Mark notifications as read — pass specific notificationIds, or readAll:true to clear everything. Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Mark notifications read', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Mark notifications read', readOnly: false, destructive: false }),
         inputSchema: z.object({
             notificationIds: z.array(z.string()).optional().describe('Specific notification ids to mark read.'),
             readAll: z.boolean().optional().describe('Mark every notification as read.'),

package/dist/tools/playlists.js

@@ -42,7 +42,7 @@ export function registerPlaylistTools(server, client) {
     });
     server.registerTool('vibo_export_event_to_spotify', {
         description: "Export an event's song selections to a new Spotify playlist (Spotify must be connected). Returns the playlist URL plus how many tracks exported / failed. Confirm-gated.",
-        annotations: toolAnnotations({ title: 'Export event to Spotify', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Export event to Spotify', readOnly: false, destructive: false }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             sectionIds: z.array(z.string()).min(1).describe('Section ids to include (from vibo_list_sections).'),
@@ -63,7 +63,7 @@ export function registerPlaylistTools(server, client) {
     });
     server.registerTool('vibo_export_event_to_apple_music', {
         description: "Export an event's song selections to a new Apple Music playlist (Apple Music must be connected). Returns the playlist URL plus how many tracks exported / failed. Confirm-gated.",
-        annotations: toolAnnotations({ title: 'Export event to Apple Music', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Export event to Apple Music', readOnly: false, destructive: false }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             sectionIds: z.array(z.string()).min(1).describe('Section ids to include (from vibo_list_sections).'),

package/dist/tools/questions.js

@@ -25,7 +25,7 @@ export function registerQuestionTools(server, client, resolveUpload = nodeUpload
     });
     server.registerTool('vibo_answer_question', {
         description: "Answer a section planning question. Provide the field matching the question's type: `text` for a text question, `selectedOptions` (array of option _ids from vibo_list_section_questions) for radio/checkbox/select, or `link` (array of URLs) for a link question. Use `otherOptionTitle` with the question's \"other\" option. For photo/file questions, pass local paths (`imagePaths`/`filePaths`) when the server can read your disk, or inline base64 bytes (`images`/`files`) otherwise. Confirm-gated.",
-        annotations: toolAnnotations({ title: 'Answer Vibo question', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Answer Vibo question', readOnly: false, destructive: false }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             sectionId: z.string().describe('Section id.'),

package/dist/tools/section-edit.js

@@ -5,7 +5,7 @@ import { previewResult } from './shared.js';
 export function registerSectionEditTools(server, client) {
     server.registerTool('vibo_update_section', {
         description: "Edit a timeline section's name, time, note, or description. Subject to the section's host-edit permissions. Confirm-gated.",
-        annotations: toolAnnotations({ title: 'Update Vibo section', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Update Vibo section', readOnly: false, destructive: false }),
         inputSchema: z.object({
             eventId: z.string(),
             sectionId: z.string(),

package/dist/tools/session.js

@@ -8,7 +8,7 @@ import { GET_ME } from '../gql.js';
 export function registerSessionTools(server, client) {
     server.registerTool('vibo_capture_session', {
         description: "Capture your Vibo login from a signed-in web.vibodj.com browser tab via the fetchproxy bridge — for accounts that sign in with Apple/Google/Facebook (no password). Requires the fetchproxy browser extension installed and you signed into https://web.vibodj.com; approve the pair code shown on first use. The token is saved locally and reused on future calls.",
-        annotations: toolAnnotations({ title: 'Capture Vibo session (SSO)', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Capture Vibo session (SSO)', readOnly: false, destructive: false }),
     }, async () => {
         const { accessToken, refreshToken } = await captureViboSession();
         client.setTokens(accessToken, refreshToken);

package/dist/tools/song-management.js

@@ -5,7 +5,7 @@ import { previewResult } from './shared.js';
 export function registerSongManagementTools(server, client) {
     server.registerTool('vibo_remove_song_from_section', {
         description: 'Remove one or more songs from a section. Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Remove songs from Vibo section', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Remove songs from Vibo section', readOnly: false, destructive: true }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             sectionId: z.string().describe('Section id.'),
@@ -24,7 +24,7 @@ export function registerSongManagementTools(server, client) {
     });
     server.registerTool('vibo_update_song', {
         description: 'Update songs in a section: mark must-play, flag as do-not-play, and/or set a comment. Provide at least one field. Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Update Vibo section songs', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Update Vibo section songs', readOnly: false, destructive: false }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             sectionId: z.string().describe('Section id.'),
@@ -58,7 +58,7 @@ export function registerSongManagementTools(server, client) {
     });
     server.registerTool('vibo_move_song', {
         description: 'Move songs from one section to another. Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Move Vibo section songs', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Move Vibo section songs', readOnly: false, destructive: false }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             sourceSectionId: z.string().describe('Section id the songs are currently in.'),
@@ -78,7 +78,7 @@ export function registerSongManagementTools(server, client) {
     });
     server.registerTool('vibo_reorder_songs', {
         description: 'Reorder songs within a section. Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Reorder Vibo section songs', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Reorder Vibo section songs', readOnly: false, destructive: false }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             sectionId: z.string().describe('Section id.'),

package/dist/tools/songs.js

@@ -96,7 +96,7 @@ export function registerSongTools(server, client) {
             '`quality.confidence`: adding a `likely-not-original` result puts a cover, karaoke ' +
             'track or junk-metadata re-upload in front of a live DJ. If nothing looks original, ' +
             'report the closest matches back rather than adding a best guess. Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Add song to Vibo section', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Add song to Vibo section', readOnly: false, destructive: false }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             sectionId: z.string().describe('Section id to add the song to.'),
@@ -126,7 +126,7 @@ export function registerSongTools(server, client) {
     });
     server.registerTool('vibo_toggle_song_like', {
         description: 'Like or unlike a song in a section. Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Like/unlike Vibo song', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Like/unlike Vibo song', readOnly: false, destructive: false }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             sectionId: z.string().describe('Section id.'),

package/dist/tools/uploads.js

@@ -12,7 +12,7 @@ import { previewResult } from './shared.js';
 export function registerUploadTools(server, client, resolveUpload = nodeUploadResolver) {
     server.registerTool('vibo_set_profile_photo', {
         description: 'Set your Vibo profile photo from an image. Pass a local file `path` if the server shares your filesystem; otherwise pass the image bytes as base64 `fileData`. Returns the uploaded image URL. Confirm-gated.',
-        annotations: toolAnnotations({ title: 'Set Vibo profile photo', readOnly: false }),
+        annotations: toolAnnotations({ title: 'Set Vibo profile photo', readOnly: false, destructive: false }),
         inputSchema: z.object({
             path: z.string().optional().describe('Absolute path to a local image file (jpg/png). Local/stdio server only.'),
             fileData: z

package/dist/version.js

@@ -2,4 +2,4 @@
 // literal on the line carrying the release marker; every manifest and the MCP
 // server banner import VERSION from here, so there is exactly one place to keep
 // in sync (and one release-please extra-files entry).
-export const VERSION = '2.1.0'; // x-release-please-version
+export const VERSION = '2.2.1'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibo-mcp",
-  "version": "2.1.0",
+  "version": "2.2.1",
   "mcpName": "io.github.chrischall/vibo-mcp",
   "description": "Vibo (vibodj.com) MCP server for Claude — host/couple event music planning & management. Developed and maintained by AI (Claude Code).",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -46,7 +46,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^1.0.0",
+    "@chrischall/mcp-utils": "^2.2.0",
     "@fetchproxy/bootstrap": "^3.0.1",
     "@modelcontextprotocol/server": "^2.0.0",
     "dotenv": "^17.4.0",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/vibo-mcp",
     "source": "github"
   },
-  "version": "2.1.0",
+  "version": "2.2.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "vibo-mcp",
-      "version": "2.1.0",
+      "version": "2.2.1",
       "transport": {
         "type": "stdio"
       },