webflow-mcp 0.3.0 → 0.3.1

package/README.md

@@ -40,16 +40,19 @@ OpenCode example:
       "command": ["webflow-mcp"],
       "environment": {
         "WEBFLOW_RELAY_MCP_URL": "https://relay.webflowmcp.es/mcp",
-        "WEBFLOW_RELAY_MCP_TOKEN": "{env:WEBFLOW_MCP_TOKEN}"
+        "WEBFLOW_RELAY_MCP_TOKEN": "tok_paste_your_token_here"
       }
     }
   }
 }
 ```
 
-Set `WEBFLOW_MCP_TOKEN` outside a checked-in project config to the `tok_...` value created in the
-dashboard. The MCP token authenticates only `/mcp`; the background worker uses its independent
-browser-paired `wkr_...` credential. Start and stop the worker through `start_worker`/`stop_worker`.
+Put this entry only in your user-global MCP client configuration, never in a project file or repository.
+The `tok_...` value is shown once when created in the dashboard and is a revocable bearer credential:
+while your worker is online, anyone holding it can invoke the flows available to your account. Advanced
+or ephemeral environments may inject the same two `WEBFLOW_RELAY_MCP_*` values instead of storing them
+in client configuration. The background worker uses its independent browser-paired `wkr_...` credential
+and never inherits the MCP token. Start and stop it through `start_worker`/`stop_worker`.
 
 Gateway mode exposes a stable catalog surface rather than one dynamic tool per saved flow. Discover with
 `browse_catalog`/`search_flows`, inspect with `describe_flow`, and execute saved flows with

package/dist/src/mcp/relay-gateway.js

@@ -72,7 +72,7 @@ export class RelayGateway {
         if (this.connecting)
             return this.connecting;
         this.connecting = (async () => {
-            const client = new Client({ name: 'webflow-local-gateway', version: '0.3.0' });
+            const client = new Client({ name: 'webflow-local-gateway', version: '0.3.1' });
             const transport = new StreamableHTTPClientTransport(this.config.url, {
                 requestInit: {
                     headers: { Authorization: `Bearer ${this.config.token}` },

package/dist/src/worker/lifecycle.js

@@ -99,6 +99,7 @@ export async function startBackgroundWorker(options = {}) {
         args.push('--browser-visibility', options.browserVisibility);
     const childEnvironment = { ...process.env };
     delete childEnvironment[RELAY_MCP_TOKEN_ENV];
+    delete childEnvironment.WEBFLOW_MCP_TOKEN;
     const child = spawn(process.execPath, [cliEntryPath, ...args], {
         detached: true,
         stdio: ['ignore', logFd, logFd],

package/dist/src/worker/protocol.d.ts

@@ -5,7 +5,7 @@ import type { BrowserVisibility, GlobalVisibilityPreference } from '../config/we
 import type { BrowserMode } from '../runner/types.js';
 import type { SignedFlowRelease } from '../security/flow-release.js';
 export declare const WORKER_PROTOCOL_VERSION = 2;
-export declare const WORKER_VERSION = "0.3.0";
+export declare const WORKER_VERSION = "0.3.1";
 export declare const SUPPORTED_FLOW_RELEASE_FORMATS: readonly [1];
 export declare const SUPPORTED_FLOW_RUNTIME_APIS: readonly [1];
 /**

package/dist/src/worker/protocol.js

@@ -1,6 +1,6 @@
 import { WebFlowError } from '../shared/errors.js';
 export const WORKER_PROTOCOL_VERSION = 2;
-export const WORKER_VERSION = '0.3.0';
+export const WORKER_VERSION = '0.3.1';
 export const SUPPORTED_FLOW_RELEASE_FORMATS = [1];
 export const SUPPORTED_FLOW_RUNTIME_APIS = [1];
 function isRecord(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webflow-mcp",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "WebFlow MCP MVP with local flow workspaces and MCP tool exposure",
   "license": "UNLICENSED",
   "type": "module",