@clipy/mcp - npm Package Compare versions

Comparing version 0.11.0 to 0.12.0

package.json

 {
   "name": "@clipy/mcp",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "mcpName": "online.clipy/mcp",
@@ -5,0 +5,0 @@ "description": "Model Context Protocol (MCP) server for Clipy — give Claude, Cursor, and other AI agents read access to your screen recordings' transcripts, AI summaries, and key moments with frames.",

README.md

@@ -29,5 +29,3 @@ # @clipy/mcp
 
-This is a headless server process, so it authenticates with a Clipy API key in the
-`CLIPY_API_KEY` env var (it looks like `clipy_sk_live_…`). The easiest way to get one is
-the Clipy CLI's browser login:
+Log in once with the Clipy CLI:
 
@@ -39,19 +37,7 @@ ```bash
 It opens your browser; click **Approve** once. The key is saved to
-`~/.config/clipy/config.json` — copy its `apiKey` value into `CLIPY_API_KEY` when you add
-the server below.
+`~/.config/clipy/config.json`, **and this server reads that file** — so there is no key to
+copy anywhere, and no secret ends up in your shell history or your MCP config.
 
-**Prefer to mint one by hand?** Create a key at
-**https://clipy.online/settings/api-keys** instead (it's shown only once — copy it
-immediately).
-
 Then add the server to your MCP client.
 
-> **Never inline your key into the server's launch command** — e.g.
-> `"command": "sh", "args": ["-c", "CLIPY_API_KEY=… npx -y @clipy/mcp"]`. Command-line
-> arguments are visible to **every local process** via the process table (`ps`, `/proc`),
-> so a key placed there is effectively world-readable on the machine. Always put it in the
-> `env` block, exactly as every example below does. (The one-time `claude mcp add --env …` /
-> `codex mcp add --env …` helpers below write that `env` block for you — they expose the key
-> only in the argv of that single setup command, never in the long-running server's.)
-
 ### Claude Code
@@ -63,3 +49,3 @@
 ```bash
-claude mcp add --scope user clipy --env CLIPY_API_KEY=clipy_sk_live_xxx -- npx -y @clipy/mcp
+claude mcp add --scope user clipy -- npx -y @clipy/mcp
 ```
@@ -73,3 +59,3 @@
 ```bash
-codex mcp add clipy --env CLIPY_API_KEY=clipy_sk_live_xxx -- npx -y @clipy/mcp
+codex mcp add clipy -- npx -y @clipy/mcp
 ```
@@ -83,3 +69,2 @@
 args = ["-y", "@clipy/mcp"]
-env = { CLIPY_API_KEY = "clipy_sk_live_xxx" }
 ```
@@ -97,4 +82,3 @@
       "command": "npx",
-      "args": ["-y", "@clipy/mcp"],
-      "env": { "CLIPY_API_KEY": "clipy_sk_live_xxx" }
+      "args": ["-y", "@clipy/mcp"]
     }
@@ -105,2 +89,20 @@ }
 
+Add an `"env": { "CLIPY_API_KEY": "clipy_sk_live_xxx" }` block only if you are not using
+`clipy login` on this machine.
+
+### Setting the key explicitly
+
+Use `CLIPY_API_KEY` when there is no `clipy login` to read from — CI, a container — or
+when you deliberately want a different key than the logged-in one. An explicit env var
+always wins over the config file. Mint keys at
+**https://clipy.online/settings/api-keys** (shown only once).
+
+> **Never inline your key into the server's launch command** — e.g.
+> `"command": "sh", "args": ["-c", "CLIPY_API_KEY=… npx -y @clipy/mcp"]`. Command-line
+> arguments are visible to **every local process** via the process table (`ps`, `/proc`),
+> so a key placed there is effectively world-readable on the machine. Put it in the `env`
+> block instead. (`claude mcp add --env …` / `codex mcp add --env …` write that `env` block
+> for you — they expose the key only in the argv of that single setup command, never in the
+> long-running server's.)
+
 ## Tools
@@ -274,3 +276,3 @@
 | --- | --- | --- | --- |
-| `CLIPY_API_KEY` | yes | — | Your personal key from `/settings/api-keys`. |
+| `CLIPY_API_KEY` | no | `apiKey` from `~/.config/clipy/config.json` | Your personal key from `/settings/api-keys`. Set it only when `clipy login` has not run on this machine; when set it overrides the config file. |
 | `CLIPY_API_URL` | no | `https://clipy.online` | Override for self-hosted/staging. |
@@ -277,0 +279,0 @@

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Improved metrics

Total package byte prevSize

159658

1.07%

Lines of code

2781

1.16%

Number of lines in readme file

277

0.73%

Worsened metrics

Number of low supply chain risk alerts

11

22.22%

No dependency changes