vibo-mcp 2.3.0 → 2.3.1

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Vibo (vibodj.com) — plan & manage event music, song requests, ideas, guests, and playlists via natural language",
-    "version": "2.3.0"
+    "version": "2.3.1"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Vibo",
       "source": "./",
       "description": "MCP server for Vibo — browse & manage events, timeline, songs, the DJ song ideas/questions, guests, and exports to Spotify/Apple Music",
-      "version": "2.3.0",
+      "version": "2.3.1",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "vibo-mcp",
   "displayName": "Vibo",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "MCP server for Vibo (vibodj.com) — plan & manage event music, song requests, ideas, guests, and playlists via natural language",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -35165,7 +35165,7 @@ function toolAnnotations(opts = {}) {
 }
 
 // src/version.ts
-var VERSION = "2.3.0";
+var VERSION = "2.3.1";
 
 // src/client.ts
 import { createHash as createHash4 } from "crypto";
@@ -36000,7 +36000,9 @@ var UPLOAD_USER_PHOTO = `
 // src/view.ts
 var VIBO_VIEWS = ["compact", "full"];
 var NOTE = `compact strips image/avatar URLs from the response; "full" returns Vibo's payload untouched. No field projection: this server has no verified record of which Vibo fields matter, and inventing one would risk dropping a field a caller needs.`;
+var EVENT_USERS_NOTE = `compact (default) returns each member as {_id, firstName, lastName, role} only \u2014 no email addresses or avatar URLs; "full" returns Vibo's payload untouched, emails included. This document's field list is fixed by its query, so the projection cannot drop an unknown field.`;
 var viewArg = () => viewParam(VIBO_VIEWS, { note: NOTE });
+var eventUsersViewArg = () => viewParam(VIBO_VIEWS, { note: EVENT_USERS_NOTE });
 function viewResponse(view, data) {
   const rung = resolveView(view, VIBO_VIEWS);
   return minifiedResult(rung === "compact" ? stripMediaUrls(data) : data);
@@ -37193,16 +37195,23 @@ function registerImportTools(server, client2) {
 }
 
 // src/tools/collaboration.ts
+function membersForView(view, users) {
+  if (resolveView(view, VIBO_VIEWS) !== "compact") return users;
+  return users.map((u) => {
+    const { _id, firstName, lastName, role } = u ?? {};
+    return { _id, firstName, lastName, role };
+  });
+}
 function registerCollaborationTools(server, client2) {
   server.registerTool(
     "vibo_list_event_users",
     {
-      description: "List the hosts and guests on an event. With no usersType, returns both groups merged ({hosts, guests, hostsCount, guestsCount}) and `limit`/`skip` apply per group; with usersType, returns that one group's page.",
+      description: "List the hosts and guests on an event. With no usersType, returns both groups merged ({hosts, guests, hostsCount, guestsCount}) and `limit`/`skip` apply per group; with usersType, returns that one group's page. Default (compact) view returns each member's id, name and role only; pass view:'full' for email addresses and avatars.",
       annotations: toolAnnotations({ title: "List Vibo event users", readOnly: true }),
       inputSchema: external_exports.object({
         eventId: external_exports.string().describe("Event id."),
         usersType: external_exports.enum(["host", "guest"]).optional().describe("Filter to only hosts or only guests."),
-        view: viewArg(),
+        view: eventUsersViewArg(),
         limit: limitSchema.describe("Max items to return (default 20). Applies per group when usersType is omitted."),
         skip: skipSchema
       })
@@ -37215,15 +37224,19 @@ function registerCollaborationTools(server, client2) {
           usersType,
           pagination: page
         });
-        return viewResponse(view, { ...data.eventUsers, usersType });
+        return viewResponse(view, {
+          ...data.eventUsers,
+          users: membersForView(view, data.eventUsers.users),
+          usersType
+        });
       }
       const [hosts, guests] = await Promise.all([
         client2.gql(LIST_EVENT_USERS, { eventId, usersType: "host", pagination: page }),
         client2.gql(LIST_EVENT_USERS, { eventId, usersType: "guest", pagination: page })
       ]);
       return viewResponse(view, {
-        hosts: hosts.eventUsers.users,
-        guests: guests.eventUsers.users,
+        hosts: membersForView(view, hosts.eventUsers.users),
+        guests: membersForView(view, guests.eventUsers.users),
         hostsCount: hosts.eventUsers.totalCount,
         guestsCount: guests.eventUsers.totalCount
       });

package/dist/tools/collaboration.js

@@ -1,16 +1,24 @@
 import { z } from 'zod';
-import { minifiedResult, confirmTokenParam, toolAnnotations } from '@chrischall/mcp-utils';
+import { minifiedResult, confirmTokenParam, resolveView, toolAnnotations } from '@chrischall/mcp-utils';
 import { LIST_EVENT_USERS, INVITE_USERS, CHANGE_USER_ROLE, REMOVE_USER } from '../gql.js';
 import { limitSchema, skipSchema, pagination, confirmWrite, CONFIRM_NOTE } from './shared.js';
-import { viewArg, viewResponse } from '../view.js';
+import { eventUsersViewArg, viewResponse, VIBO_VIEWS } from '../view.js';
+function membersForView(view, users) {
+    if (resolveView(view, VIBO_VIEWS) !== 'compact')
+        return users;
+    return users.map((u) => {
+        const { _id, firstName, lastName, role } = (u ?? {});
+        return { _id, firstName, lastName, role };
+    });
+}
 export function registerCollaborationTools(server, client) {
     server.registerTool('vibo_list_event_users', {
-        description: "List the hosts and guests on an event. With no usersType, returns both groups merged ({hosts, guests, hostsCount, guestsCount}) and `limit`/`skip` apply per group; with usersType, returns that one group's page.",
+        description: "List the hosts and guests on an event. With no usersType, returns both groups merged ({hosts, guests, hostsCount, guestsCount}) and `limit`/`skip` apply per group; with usersType, returns that one group's page. Default (compact) view returns each member's id, name and role only; pass view:'full' for email addresses and avatars.",
         annotations: toolAnnotations({ title: 'List Vibo event users', readOnly: true }),
         inputSchema: z.object({
             eventId: z.string().describe('Event id.'),
             usersType: z.enum(['host', 'guest']).optional().describe('Filter to only hosts or only guests.'),
-            view: viewArg(),
+            view: eventUsersViewArg(),
             limit: limitSchema.describe('Max items to return (default 20). Applies per group when usersType is omitted.'),
             skip: skipSchema,
         }),
@@ -22,7 +30,11 @@ export function registerCollaborationTools(server, client) {
                 usersType,
                 pagination: page,
             });
-            return viewResponse(view, { ...data.eventUsers, usersType });
+            return viewResponse(view, {
+                ...data.eventUsers,
+                users: membersForView(view, data.eventUsers.users),
+                usersType,
+            });
         }
         // The API returns nothing unless usersType is set, so fetch both groups
         // and merge for the intuitive "everyone on the event" listing.
@@ -34,8 +46,8 @@ export function registerCollaborationTools(server, client) {
         // when `usersType` is omitted — the default call — so honouring `view` on
         // only the filtered branch would leave the common path paying full price.
         return viewResponse(view, {
-            hosts: hosts.eventUsers.users,
-            guests: guests.eventUsers.users,
+            hosts: membersForView(view, hosts.eventUsers.users),
+            guests: membersForView(view, guests.eventUsers.users),
             hostsCount: hosts.eventUsers.totalCount,
             guestsCount: guests.eventUsers.totalCount,
         });

package/dist/version.js

@@ -2,4 +2,4 @@
 // literal on the line carrying the release marker; every manifest and the MCP
 // server banner import VERSION from here, so there is exactly one place to keep
 // in sync (and one release-please extra-files entry).
-export const VERSION = '2.3.0'; // x-release-please-version
+export const VERSION = '2.3.1'; // x-release-please-version

package/dist/view.js

@@ -18,13 +18,26 @@ import { minifiedResult, resolveView, stripMediaUrls, viewParam } from '@chrisch
  * When a real payload can be captured, a field projection belongs here beside
  * this one and will save considerably more. Until then this is the honest
  * ceiling, and this docblock says so rather than implying a shape was checked.
+ *
+ * One exception: `vibo_list_event_users` projects its members to
+ * `{_id, firstName, lastName, role}` on compact, because its document's field
+ * list is fixed by the query and the dropped `email` is third-party PII
+ * (fleet-audit #1136). See `membersForView` in `tools/collaboration.ts`.
  */
 export const VIBO_VIEWS = ['compact', 'full'];
 const NOTE = 'compact strips image/avatar URLs from the response; "full" returns Vibo\'s payload untouched. ' +
     'No field projection: this server has no verified record of which Vibo fields matter, and inventing ' +
     'one would risk dropping a field a caller needs.';
+const EVENT_USERS_NOTE = 'compact (default) returns each member as {_id, firstName, lastName, role} only — no email addresses or ' +
+    'avatar URLs; "full" returns Vibo\'s payload untouched, emails included. This document\'s field list is ' +
+    'fixed by its query, so the projection cannot drop an unknown field.';
 /** The `view` parameter every read tool in this server takes. */
 export const viewArg = () => viewParam(VIBO_VIEWS, { note: NOTE });
+/**
+ * `vibo_list_event_users`' `view` parameter — the one exception to NOTE's
+ * "no field projection" (see the docblock above), so its schema says so.
+ */
+export const eventUsersViewArg = () => viewParam(VIBO_VIEWS, { note: EVENT_USERS_NOTE });
 /**
  * Answer in the requested rung.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibo-mcp",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "mcpName": "io.github.chrischall/vibo-mcp",
   "description": "Vibo (vibodj.com) MCP server for Claude — host/couple event music planning & management. Developed and maintained by AI (Claude Code).",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/vibo-mcp",
     "source": "github"
   },
-  "version": "2.3.0",
+  "version": "2.3.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "vibo-mcp",
-      "version": "2.3.0",
+      "version": "2.3.1",
       "transport": {
         "type": "stdio"
       },

package/skills/vibo-mcp/SKILL.md

@@ -104,7 +104,7 @@ They are exactly the six reads whose GraphQL document asks Vibo for media:
 | `vibo_search_songs` | `thumbnails { s180x180 original }` per track |
 | `vibo_get_section_songs` | `thumbnails { s180x180 original }` per song |
 | `vibo_list_song_ideas_songs` | `thumbnails { s180x180 original }` per song |
-| `vibo_list_event_users` | `imageUrl` per person (both exits — merged and filtered) |
+| `vibo_list_event_users` | `email` + `imageUrl` per person — projected to `_id`/`firstName`/`lastName`/`role` on both exits (merged and filtered); `view: "full"` for emails |
 | `vibo_list_notifications` | `imageUrl` per notification |
 | `vibo_get_me` | `imageUrl` |
 
@@ -117,6 +117,11 @@ writes no field list, because this repo holds no captured Vibo payload to
 derive one from honestly; instead it removes keys whose value is a picture,
 which is subtractive and so cannot drop a field nobody knew about.
 
+The one exception is `vibo_list_event_users`: its query fixes the member field
+list, so compact projects each member to `_id`/`firstName`/`lastName`/`role`
+and keeps other people's email addresses out of the default answer (fleet-audit
+#1136). Ask for `view: "full"` only when an email is actually needed.
+
 What compact does **not** touch is the point of these tools: `songUrl`, the
 `links` block (`spotify` / `youtube` / `appleMusic`) and the `quality` verdict
 all survive. A streaming link is this server's product, not decoration —