uber-mcp 0.1.2__py3-none-any.whl

uber_login/__init__.py

@@ -0,0 +1,9 @@
+"""uber-login: the browser a person signs in to Uber with, shown to them through a remote-desktop view.
+
+The person sees Uber's own sign-in page, running in a Chromium next to the server, through noVNC. They sign in
+exactly as on uber.com (code, Google, Apple or QR code); this service automates nothing on the sign-in
+(``tests/test_login_safety.py`` pins that). It only notices when Uber says signed in, opens Uber's trips site once
+(Uber's single sign-on for it), checks both from the same browser, hands the session to uber-mcp once and closes
+the browser. It holds no session of its own and no key; only uber-mcp can call it (a bearer).
+``window.sign_in`` is the same window on the person's own screen, for ``uber-mcp login``.
+"""

uber_login/__main__.py

@@ -0,0 +1,3 @@
+from .app import main
+
+main()

uber_login/app.py

@@ -0,0 +1,218 @@
+"""The login service's API. uber-mcp (``uber-mcp admin login``) holds its bearer; the person, one view token.
+
+POST   /logins               {"layout": "phone"|"desktop"} -> 201 {id, state, view_token, ...} | 503 busy  (bearer)
+GET    /logins/{id}          -> {id, state, host, error, layout}                                     (bearer)
+POST   /logins/{id}/result   -> the proven session once {account, user_agent, cookies} | 409 not yet   (bearer)
+DELETE /logins/{id}          -> 204                                                                   (bearer)
+GET    /view/{id}?t=TOKEN    -> the person's sign-in page: Uber's page through noVNC                  (view token)
+GET    /view/{id}/state?t=   -> {state, host}                                                         (view token)
+WS     /logins/{id}/vnc?t=   -> the login's remote-desktop stream (RFB), for noVNC                    (view token)
+GET    /novnc/...            -> noVNC's own files (the viewer)                                        (open)
+GET    /health               -> open
+"""
+
+from __future__ import annotations
+
+import asyncio
+import hmac
+import logging
+import os
+from pathlib import Path
+
+from starlette.applications import Starlette
+from starlette.middleware import Middleware
+from starlette.requests import Request
+from starlette.responses import HTMLResponse, JSONResponse, Response
+from starlette.routing import Mount, Route, WebSocketRoute
+from starlette.staticfiles import StaticFiles
+from starlette.types import ASGIApp, Receive, Scope, Send
+from starlette.websockets import WebSocket, WebSocketDisconnect
+
+from .logins import Busy, Logins
+
+log = logging.getLogger("uber-login")
+
+VIEW_PAGE = """<!doctype html><meta name=viewport content="width=device-width,initial-scale=1">
+<meta name=referrer content=no-referrer>
+<title>Sign in to Uber</title>
+<style>
+ html,body{margin:0;height:100%;font:15px system-ui;background:#f4f5f4}
+ header{padding:.6em 1em;background:#fff;border-bottom:1px solid #ddd}
+ header b{font-size:1.05em} .url{color:#2a7a2a;font-size:.85em;margin-top:.2em}
+ #screen{position:absolute;top:4.2em;bottom:2.4em;left:0;right:0;background:#fff}
+ footer{position:absolute;bottom:0;left:0;right:0;padding:.5em 1em;font-size:.8em;color:#555;background:#fff;
+  border-top:1px solid #ddd}
+ #done{display:none;padding:3em 1em;text-align:center;font-size:1.2em}
+</style>
+<header><b>Sign in to Uber for uber-mcp</b><div class=url id=url>auth.uber.com</div></header>
+<div id=screen></div><div id=done></div>
+<footer id=status>Sign in as you normally do (code, Google, Apple or QR code). This page finishes by itself.</footer>
+<script type=module>
+import RFB from '/novnc/core/rfb.js';
+const id = location.pathname.split('/')[2], t = new URLSearchParams(location.search).get('t');
+history.replaceState(null, '', location.pathname);  // keep the token out of the address bar
+const ws = (location.protocol === 'https:' ? 'wss' : 'ws') + '://' + location.host;
+const rfb = new RFB(document.getElementById('screen'), `${ws}/logins/${id}/vnc?t=${encodeURIComponent(t)}`);
+rfb.scaleViewport = true; rfb.resizeSession = false; rfb.focusOnClick = true;
+const status = document.getElementById('status');
+async function poll() {
+  let s;
+  try { s = await (await fetch(`/view/${id}/state?t=${encodeURIComponent(t)}`)).json(); } catch (e) { s = {}; }
+  if (s.host) document.getElementById('url').textContent = s.host;
+  if (s.state === 'signed_in' || s.state === 'closed') {
+    rfb.disconnect(); document.getElementById('screen').remove();
+    const d = document.getElementById('done'); d.style.display = 'block';
+    d.textContent = 'Signed in. You can close this page.'; status.textContent = ''; return;
+  }
+  if (['failed', 'expired', 'unknown'].includes(s.state)) {
+    status.textContent = 'That did not work (' + s.state + ').'; return;
+  }
+  setTimeout(poll, 1000);
+}
+poll();
+</script>"""
+
+
+class BearerOnly:
+    """Every route but /health, /novnc and the person's view (its own token) needs the bearer, checked before any
+    WebSocket handshake too."""
+
+    def __init__(self, app: ASGIApp, token: str) -> None:
+        self.app, self.expected = app, f"Bearer {token}".encode()
+
+    @staticmethod
+    def _open(scope: Scope) -> bool:
+        path = scope.get("path") or ""
+        if scope["type"] == "websocket":
+            return path.startswith("/logins/") and path.endswith("/vnc")  # the view token is checked there
+        return path == "/health" or path.startswith(("/novnc/", "/view/"))
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] in ("http", "websocket") and not self._open(scope):
+            given = dict(scope.get("headers") or []).get(b"authorization", b"")
+            if not hmac.compare_digest(given, self.expected):
+                if scope["type"] == "websocket":
+                    await send({"type": "websocket.close", "code": 4401})
+                else:
+                    await Response(status_code=401)(scope, receive, send)
+                return
+        await self.app(scope, receive, send)
+
+
+def build_app(logins: Logins, *, token: str, novnc_dir: Path) -> Starlette:
+    async def health(_: Request) -> JSONResponse:
+        return JSONResponse({"status": "healthy"})
+
+    async def start(request: Request) -> JSONResponse:
+        try:
+            body = await request.json()
+        except ValueError:
+            body = {}
+        layout = body.get("layout") if isinstance(body, dict) else None
+        try:
+            login = await logins.start(layout if layout in ("phone", "desktop") else "desktop")
+        except Busy:
+            return JSONResponse({"error": "busy"}, status_code=503)
+        return JSONResponse({**login.public(), "view_token": login.view_token}, status_code=201)
+
+    async def state(request: Request) -> JSONResponse:
+        login = logins.get(request.path_params["id"])
+        if login is None:
+            return JSONResponse({"error": "unknown"}, status_code=404)
+        return JSONResponse(login.public())
+
+    async def result(request: Request) -> JSONResponse:
+        login_id = request.path_params["id"]
+        if logins.get(login_id) is None:
+            return JSONResponse({"error": "unknown"}, status_code=404)
+        session = logins.take(login_id)
+        if session is None:
+            return JSONResponse({"error": "not_signed_in"}, status_code=409)
+        return JSONResponse(session)
+
+    async def close(request: Request) -> Response:
+        await logins.close(request.path_params["id"])
+        return Response(status_code=204)
+
+    def _viewable(login_id: str, view_token: str):  # type: ignore[no-untyped-def]
+        login = logins.get(login_id)
+        return login if login is not None and login.view_ok(view_token) else None
+
+    async def view(request: Request) -> Response:
+        if _viewable(request.path_params["id"], request.query_params.get("t", "")) is None:
+            return Response(status_code=404)
+        return HTMLResponse(VIEW_PAGE, headers={"Cache-Control": "no-store", "X-Frame-Options": "DENY"})
+
+    async def view_state(request: Request) -> JSONResponse:
+        login = _viewable(request.path_params["id"], request.query_params.get("t", ""))
+        if login is None:
+            return JSONResponse({"state": "unknown"})
+        return JSONResponse({"state": login.state, "host": login.host})
+
+    async def vnc(ws: WebSocket) -> None:
+        login = _viewable(ws.path_params["id"], ws.query_params.get("t", ""))
+        if login is None or login.state not in ("starting", "waiting"):
+            await ws.close(code=4404)
+            return
+        await ws.accept(subprotocol="binary" if "binary" in ws.scope.get("subprotocols", []) else None)
+        try:
+            reader, writer = await asyncio.open_connection("127.0.0.1", login.vnc_port)
+        except OSError:
+            await ws.close(code=1011)
+            return
+
+        async def upstream() -> None:
+            try:
+                while True:
+                    message = await ws.receive()
+                    if message["type"] == "websocket.disconnect":
+                        return
+                    writer.write(message.get("bytes") or (message.get("text") or "").encode())
+                    await writer.drain()
+            except (WebSocketDisconnect, ConnectionError):
+                return
+
+        async def downstream() -> None:
+            try:
+                while data := await reader.read(65536):
+                    await ws.send_bytes(data)
+            except (WebSocketDisconnect, ConnectionError, RuntimeError):
+                return
+
+        tasks = [asyncio.create_task(upstream()), asyncio.create_task(downstream())]
+        await asyncio.wait(tasks, return_when=asyncio.FIRST_COMPLETED)
+        for task in tasks:
+            task.cancel()
+        writer.close()
+
+    routes = [
+        Route("/health", health),
+        Route("/logins", start, methods=["POST"]),
+        Route("/logins/{id}", state, methods=["GET"]),
+        Route("/logins/{id}", close, methods=["DELETE"]),
+        Route("/logins/{id}/result", result, methods=["POST"]),
+        Route("/view/{id}", view, methods=["GET"]),
+        Route("/view/{id}/state", view_state, methods=["GET"]),
+        WebSocketRoute("/logins/{id}/vnc", vnc),
+    ]
+    if novnc_dir.is_dir():
+        routes.append(Mount("/novnc", app=StaticFiles(directory=novnc_dir)))
+    return Starlette(routes=routes, middleware=[Middleware(BearerOnly, token=token)])
+
+
+def main() -> None:
+    import uvicorn
+
+    logging.basicConfig(level=logging.INFO, format="%(asctime)s %(name)s %(levelname)s %(message)s")
+    token = (os.environ.get("UBER_LOGIN_TOKEN") or "").strip()
+    if len(token) < 32:
+        raise SystemExit("UBER_LOGIN_TOKEN (at least 32 characters) is required")
+    logins = Logins(
+        slots=int(os.environ.get("UBER_LOGIN_SLOTS") or 1),
+        minutes=int(os.environ.get("UBER_LOGIN_MINUTES") or 20),
+        xvfb=os.environ.get("UBER_LOGIN_XVFB") or "Xvfb",
+        x11vnc=os.environ.get("UBER_LOGIN_X11VNC") or "x11vnc",
+    )
+    novnc = Path(os.environ.get("UBER_LOGIN_NOVNC") or "/usr/share/novnc")
+    app = build_app(logins, token=token, novnc_dir=novnc)
+    uvicorn.run(app, host="0.0.0.0", port=int(os.environ.get("PORT") or 8080), log_level="warning")

uber_login/logins.py

@@ -0,0 +1,215 @@
+"""One login = one virtual display, one remote-desktop server on loopback and one throwaway Chromium profile.
+
+States: ``starting`` -> ``waiting`` (Uber's sign-in page is up; the person is signing in) -> ``signed_in``
+(proven; the session waits to be taken once) -> ``closed``; or ``failed`` / ``expired`` / ``closed`` early.
+Nothing here clicks, types or fills: the person does every step of the sign-in. Each login has its own view token,
+which only the caller that started it gets: the person's viewer page and remote-desktop stream need it.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import logging
+import os
+import secrets
+import shutil
+import subprocess
+import tempfile
+import time
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass, field
+from typing import Any
+
+from .window import DOCUMENT_HOSTS, LAYOUTS, LOGIN_URL, allowed_document, sign_in
+
+__all__ = ["DOCUMENT_HOSTS", "LOGIN_URL", "Busy", "Login", "Logins", "allowed_document"]
+
+log = logging.getLogger("uber-login")
+
+RESULT_TTL = 5 * 60  # a proven session waits this long to be taken, then it is dropped
+
+
+class Busy(Exception):
+    """Every login slot is in use."""
+
+
+@dataclass
+class Login:
+    id: str
+    layout: str
+    slot: int
+    created: float
+    state: str = "starting"
+    host: str = ""
+    error: str | None = None
+    result: dict[str, Any] | None = None
+    result_at: float | None = None
+    procs: list[subprocess.Popen] = field(default_factory=list)
+    profile: str | None = None
+    task: asyncio.Task | None = None
+    view_token: str = field(default_factory=lambda: secrets.token_urlsafe(24))
+
+    @property
+    def display(self) -> str:
+        return f":{90 + self.slot}"
+
+    @property
+    def vnc_port(self) -> int:
+        return 5990 + self.slot
+
+    def public(self) -> dict[str, Any]:
+        return {"id": self.id, "state": self.state, "host": self.host, "error": self.error, "layout": self.layout}
+
+    def view_ok(self, token: str) -> bool:
+        return secrets.compare_digest(token or "", self.view_token)
+
+
+Browser = Callable[[Login, "Logins"], Awaitable[None]]
+
+
+class Logins:
+    def __init__(
+        self,
+        *,
+        slots: int = 2,
+        minutes: int = 15,
+        xvfb: str = "Xvfb",
+        x11vnc: str = "x11vnc",
+        browser: Browser | None = None,
+        clock: Callable[[], float] = time.monotonic,
+    ) -> None:
+        self.slots, self.limit = slots, minutes * 60
+        self.xvfb, self.x11vnc = xvfb, x11vnc
+        self._browser = browser or run_browser
+        self._clock = clock
+        self._logins: dict[str, Login] = {}
+        self._lock = asyncio.Lock()
+
+    async def start(self, layout: str) -> Login:
+        if layout not in LAYOUTS:
+            raise ValueError("layout")
+        async with self._lock:
+            self.reap()
+            used = {login.slot for login in self._logins.values()}
+            free = [slot for slot in range(self.slots) if slot not in used]
+            if not free:
+                raise Busy()
+            login = Login(secrets.token_urlsafe(18), layout, free[0], self._clock())
+            self._logins[login.id] = login
+        try:
+            await asyncio.to_thread(self._start_display, login)
+        except Exception:
+            await self.close(login.id, "failed", "display")
+            raise
+        login.task = asyncio.create_task(self._run(login))
+        return login
+
+    def get(self, login_id: str) -> Login | None:
+        self.reap()
+        return self._logins.get(login_id)
+
+    def take(self, login_id: str) -> dict[str, Any] | None:
+        """The proven session, once; the login is over after that."""
+        login = self.get(login_id)
+        if login is None or login.state != "signed_in" or login.result is None:
+            return None
+        result, login.result = login.result, None
+        self._forget(login, "closed")
+        return result
+
+    async def close(self, login_id: str, state: str = "closed", error: str | None = None) -> None:
+        login = self._logins.get(login_id)
+        if login is None:
+            return
+        if login.task and not login.task.done() and login.task is not asyncio.current_task():
+            login.task.cancel()
+            with contextlib.suppress(asyncio.CancelledError, Exception):
+                await login.task
+        login.error = error or login.error
+        self._forget(login, state)
+
+    def reap(self) -> None:
+        """Logins past the time limit and proven sessions nobody took are ended."""
+        now = self._clock()
+        for login in list(self._logins.values()):
+            if login.state in ("starting", "waiting") and now - login.created > self.limit:
+                if login.task:
+                    login.task.cancel()
+                self._forget(login, "expired")
+            elif login.state == "signed_in" and login.result_at and now - login.result_at > RESULT_TTL:
+                login.result = None
+                self._forget(login, "expired")
+
+    def _forget(self, login: Login, state: str) -> None:
+        login.state = state
+        self._stop_display(login)
+        self._logins.pop(login.id, None)
+        log.info("login %s ended: %s%s", login.id[:6], state, f" ({login.error})" if login.error else "")
+
+    # -- the display and its remote-desktop view ----------------------------------------------
+
+    def _start_display(self, login: Login) -> None:
+        w, h = LAYOUTS[login.layout]["size"]
+        login.procs.append(
+            subprocess.Popen(
+                [self.xvfb, login.display, "-screen", "0", f"{w}x{h}x24", "-nolisten", "tcp"],
+                stdout=subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL,
+            )
+        )
+        time.sleep(0.8)
+        # Loopback only: the service's WebSocket bridge is the one way in, behind its bearer.
+        login.procs.append(
+            subprocess.Popen(
+                [self.x11vnc, "-display", login.display, "-localhost", "-rfbport", str(login.vnc_port), "-nopw",
+                 "-forever", "-shared", "-quiet", "-noxdamage"],
+                stdout=subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL,
+            )
+        )  # fmt: skip
+        time.sleep(0.8)
+        if any(proc.poll() is not None for proc in login.procs):
+            raise RuntimeError("Xvfb or x11vnc exited at start")
+
+    def _stop_display(self, login: Login) -> None:
+        for proc in reversed(login.procs):
+            proc.terminate()
+        for proc in login.procs:
+            with contextlib.suppress(subprocess.TimeoutExpired):
+                proc.wait(timeout=5)
+        login.procs.clear()
+        if login.profile:
+            shutil.rmtree(login.profile, ignore_errors=True)
+            login.profile = None
+
+    async def _run(self, login: Login) -> None:
+        try:
+            await self._browser(login, self)
+        except asyncio.CancelledError:
+            raise
+        except Exception as exc:
+            log.warning("login %s failed: %s", login.id[:6], type(exc).__name__)
+            if login.id in self._logins and login.state != "signed_in":
+                self._forget(login, "failed")
+
+    def proven(self, login: Login, result: dict[str, Any]) -> None:
+        login.result, login.result_at, login.state = result, self._clock(), "signed_in"
+        log.info("login %s signed in", login.id[:6])
+
+
+async def run_browser(login: Login, logins: Logins) -> None:
+    """Uber's sign-in page in a fresh profile on the login's display; returns once signed in and proven."""
+    login.profile = tempfile.mkdtemp(prefix="uber-login-")
+
+    def waiting(host: str) -> None:
+        login.state, login.host = "waiting", host
+
+    result = await sign_in(
+        profile=login.profile,
+        layout=login.layout,
+        env={**os.environ, "DISPLAY": login.display},
+        extra_args=("--window-position=0,0",),
+        on_page=waiting,
+    )
+    logins.proven(login, result)

uber_login/window.py

@@ -0,0 +1,147 @@
+"""Uber's own sign-in page in a real browser window, until the person has signed in; then the proven session.
+
+Used by the login service (a window on a virtual display, shown through noVNC) and by ``uber-mcp login`` (a window
+on the person's own screen). Nothing here clicks, types or fills: the person does every step of the sign-in, Uber's
+own checks included (``tests/test_login_safety.py`` pins that). Once Uber lands on m.uber.com, the window opens
+Uber's trips site once (riders.uber.com signs in through Uber's single sign-on on first visit), reads both as the
+rider with the same cookies, and returns. Only Uber's pages (and Google's or Apple's, for their sign-in buttons)
+may be shown.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import re
+from collections.abc import Callable, Mapping
+from typing import Any
+from urllib.parse import urlsplit
+
+from uber_mcp.session import clean_cookies
+from uber_mcp.uber import ENDPOINTS, operations
+
+LOGIN_URL = "https://m.uber.com/go/login-redirect?previousPathname=%2Fgo%2Fhome"
+RIDERS_URL = "https://riders.uber.com/trips"
+RIDES_LANDED = re.compile(r"https://m\.uber\.com/go/(?!login)")
+RIDERS_LANDED = re.compile(r"https://riders\.uber\.com/")
+# Pages the window may show; anything else is refused (images, scripts and frames load freely).
+DOCUMENT_HOSTS = ("uber.com", "accounts.google.com", "appleid.apple.com")
+LAYOUTS = {
+    "desktop": {"size": (1280, 860), "user_agent": None},
+    # A phone-sized window gets Uber's mobile pages only with a mobile browser identity.
+    "phone": {
+        "size": (430, 900),
+        "user_agent": "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) "
+        "Chrome/149.0.0.0 Mobile Safari/537.36",
+    },
+}
+WATCH_EVERY = 1.5
+
+
+def allowed_document(url: str) -> bool:
+    if url.startswith(("about:", "data:", "blob:")):
+        return True
+    parts = urlsplit(url)
+    host = (parts.hostname or "").lower()
+    return parts.scheme == "https" and any(host == h or host.endswith("." + h) for h in DOCUMENT_HOSTS)
+
+
+class WindowClosed(Exception):
+    """The person closed the window before signing in."""
+
+
+class NotProven(Exception):
+    """Uber's pages said signed in, but reading the account with the same cookies did not work."""
+
+
+async def sign_in(
+    *,
+    profile: str,
+    layout: str = "desktop",
+    env: Mapping[str, str] | None = None,
+    channel: str | None = None,
+    extra_args: tuple[str, ...] = (),
+    on_page: Callable[[str], None] | None = None,
+) -> dict[str, Any]:
+    """Open Uber's sign-in page in a browser using ``profile`` and wait until the person has signed in.
+
+    Returns ``{account: {uuid, name}, user_agent, cookies}``. ``channel="chrome"`` uses the installed Google Chrome;
+    None uses the browser patchright installed. ``on_page`` hears the host of the page shown, every look.
+    """
+    from patchright.async_api import async_playwright
+
+    width, height = LAYOUTS[layout]["size"]
+    async with async_playwright() as p:
+        ctx = await p.chromium.launch_persistent_context(
+            profile,
+            channel=channel,
+            headless=False,
+            no_viewport=True,
+            user_agent=LAYOUTS[layout]["user_agent"],
+            env=dict(env) if env is not None else None,
+            args=[f"--window-size={width},{height}", *extra_args, "--no-first-run", "--disable-features=Translate"],
+        )
+        try:
+
+            async def guard(route: Any) -> None:
+                request = route.request
+                top = request.is_navigation_request() and request.frame.parent_frame is None
+                if top and not allowed_document(request.url):
+                    await route.abort()
+                    return
+                await route.continue_()
+
+            await ctx.route("**/*", guard)
+            page = ctx.pages[0] if ctx.pages else await ctx.new_page()
+            await page.goto(LOGIN_URL, wait_until="domcontentloaded", timeout=60_000)
+            while True:
+                open_pages = [pg for pg in ctx.pages if not pg.is_closed()]
+                if not open_pages:
+                    raise WindowClosed()
+                if on_page is not None:
+                    on_page(urlsplit(open_pages[0].url).hostname or "")
+                landed = next((pg for pg in open_pages if RIDES_LANDED.match(pg.url)), None)
+                if landed is not None:
+                    return await _hop_and_prove(ctx, landed)
+                await asyncio.sleep(WATCH_EVERY)
+        finally:
+            await ctx.close()
+
+
+async def _hop_and_prove(ctx: Any, page: Any) -> dict[str, Any]:
+    await page.goto(RIDERS_URL, wait_until="domcontentloaded", timeout=60_000)
+    for _ in range(40):
+        if RIDERS_LANDED.match(page.url):
+            break
+        await asyncio.sleep(0.5)
+    user = (await _graphql(ctx, "riders", "CurrentUserRidersWeb", {})).get("currentUser") or {}
+    status = (await _graphql(ctx, "rides", "GetStatus", {"latitude": 0, "longitude": 0})).get("status") or {}
+    if not user.get("uuid") or not isinstance(status, dict) or "clientStatus" not in status:
+        raise NotProven()
+    return {
+        "account": {"uuid": user["uuid"], "name": str(user.get("firstName") or "")},
+        "user_agent": await page.evaluate("() => navigator.userAgent"),
+        "cookies": clean_cookies(await ctx.cookies()),
+    }
+
+
+async def _graphql(ctx: Any, surface: str, operation: str, variables: dict[str, Any]) -> dict[str, Any]:
+    url = ENDPOINTS[surface]
+    origin = "https://" + (urlsplit(url).hostname or "")
+    response = await ctx.request.post(
+        url,
+        data=json.dumps({"operationName": operation, "query": operations()[operation], "variables": variables}),
+        headers={
+            "content-type": "application/json",
+            "accept": "application/json",
+            "x-csrf-token": "x",
+            "origin": origin,
+            "referer": origin + "/",
+        },  # fmt: skip
+    )
+    try:
+        payload = await response.json()
+    except Exception:
+        return {}
+    data = payload.get("data") if isinstance(payload, dict) else None
+    return data if isinstance(data, dict) else {}

uber_mcp/__init__.py

@@ -0,0 +1,9 @@
+"""uber-mcp: unofficial MCP access to an Uber rider account: places, live fares, rides behind a confirm step."""
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    # The release tool bumps pyproject.toml only; read the installed distribution.
+    __version__ = version("uber-mcp")
+except PackageNotFoundError:  # pragma: no cover - source tree without an install
+    __version__ = "0+unknown"

uber_mcp/__main__.py

@@ -0,0 +1,10 @@
+"""``python -m uber_mcp``: the ``uber-mcp`` command (``cli``)."""
+
+from __future__ import annotations
+
+import sys
+
+from .cli import main
+
+if __name__ == "__main__":
+    sys.exit(main())