@vaaya/mcp - npm Package Compare versions

Comparing version 0.5.1 to 0.5.2

dist/index.js

@@ -333,4 +333,64 @@ #!/usr/bin/env node
 
+// src/auth/setup.ts
+var SETUP_TOKEN_GRANT_TYPE = "urn:vaaya:params:oauth:grant-type:setup-token";
+function interpretExchange(status, body) {
+  if (status === 200 && typeof body.access_token === "string") {
+    return { kind: "ok", tokens: body };
+  }
+  if (body.error === "invalid_grant") {
+    return { kind: "rejected", reason: String(body.error_description ?? "setup_token_invalid") };
+  }
+  return {
+    kind: "error",
+    description: String(body.error_description ?? body.error ?? `unexpected status ${status}`)
+  };
+}
+function setupTokenFromEnv() {
+  const t = process.env.VAAYA_SETUP_TOKEN?.trim();
+  return t?.startsWith("vst_") ? t : null;
+}
+async function trySetupTokenAuth(token) {
+  let decision;
+  try {
+    const resp = await fetch(`${BACKEND_URL}/oauth/token`, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: SETUP_TOKEN_GRANT_TYPE,
+        setup_token: token,
+        client_id: CLIENT_ID,
+        scope: REQUIRED_SCOPES.join(" ")
+      })
+    });
+    const body = await resp.json().catch(() => ({}));
+    decision = interpretExchange(resp.status, body);
+  } catch (err) {
+    decision = { kind: "error", description: err.message };
+  }
+  if (decision.kind !== "ok") {
+    console.error("[vaaya-mcp] setup link expired or already used \u2014 opening sign-in instead.");
+    if (DEBUG) console.error(`[vaaya-mcp] setup-token exchange: ${JSON.stringify(decision)}`);
+    return null;
+  }
+  const tokens = decision.tokens;
+  const storedGrant = {
+    client_id: CLIENT_ID,
+    refresh_token: tokens.refresh_token,
+    refresh_token_expires_at: new Date(Date.now() + 60 * 24 * 60 * 60 * 1e3).toISOString(),
+    scope: tokens.scope,
+    obtained_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const creds = readCredentials();
+  creds[BACKEND_URL] = storedGrant;
+  writeCredentials(creds);
+  return { access: tokens.access_token, scope: tokens.scope };
+}
+
 // src/auth/select.ts
 async function performAuth() {
+  const setupToken = setupTokenFromEnv();
+  if (setupToken) {
+    const viaToken = await trySetupTokenAuth(setupToken);
+    if (viaToken) return viaToken;
+  }
   return AUTH_MODE === "browser" ? performLoopbackAuth() : performDeviceAuth();
@@ -959,3 +1019,5 @@ }
   let only = null;
-  for (const arg of argv) {
+  let setupToken = process.env.VAAYA_SETUP_TOKEN?.trim() || null;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i] ?? "";
     const m = /^--only=(.+)$/.exec(arg);
@@ -968,4 +1030,8 @@ if (m) {
     }
+    const t = /^--token=(.+)$/.exec(arg);
+    if (t && t[1]) setupToken = t[1];
+    if (arg === "--token" && argv[i + 1]) setupToken = argv[i + 1] ?? null;
   }
-  return { dryRun, only };
+  if (setupToken && !setupToken.startsWith("vst_")) setupToken = null;
+  return { dryRun, only, setupToken };
 }
@@ -980,2 +1046,7 @@ function shouldRun(name, opts) {
 `);
+  if (opts.setupToken && !opts.dryRun) {
+    const linked = await trySetupTokenAuth(opts.setupToken);
+    log(linked ? "Account linked via setup token \u2014 no sign-in needed." : "Setup token expired \u2014 you will be asked to sign in on first use.");
+    log("");
+  }
   log(
@@ -1061,3 +1132,3 @@ `Vaaya installer \u2014 ${opts.dryRun ? "dry-run" : "live"}${opts.only ? ` (--only=${opts.only})` : ""}`
 Usage
-  install [--dry-run] [--only=<agent>]
+  install [--dry-run] [--only=<agent>] [--token=<vst_\u2026>]
                      Set up the Vaaya MCP server for every agent detected on
@@ -1064,0 +1135,0 @@ this machine (Claude Code, Claude Desktop, Cursor, Codex).

package.json

 {
   "name": "@vaaya/mcp",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "mcpName": "ai.vaaya/mcp",
-  "description": "Vaaya MCP server \u2014 pay-per-call agent superpowers: media & video generation, product demo videos, web search & scraping, deep/market research, GTM & sales lead enrichment, code sandboxes, browser automation, email, memory. No API keys.",
+  "description": "Vaaya MCP server — pay-per-call agent superpowers: media & video generation, product demo videos, web search & scraping, deep/market research, GTM & sales lead enrichment, code sandboxes, browser automation, email, memory. No API keys.",
   "keywords": [
@@ -7,0 +7,0 @@ "mcp",

skills/vaaya/SKILL.md

@@ -55,2 +55,10 @@ ---
 
+If the user's message included a setup token (it looks like `vst_…`, handed out by the
+onboarding wizard at vaaya.ai), pass it along — it links the account instantly with no
+browser sign-in, and expires harmlessly if stale:
+
+```bash
+npx -y @vaaya/mcp install --token <vst_…>
+```
+
 This runs the published [`@vaaya/mcp`](https://www.npmjs.com/package/@vaaya/mcp) package
@@ -120,4 +128,13 @@ and wires Vaaya into whichever agents it finds (Claude Code, Claude Desktop, Cursor,
 - **Memory** — store files and retrieve them in later sessions
+- **Social-platform data** — per-call reads of profiles, posts, comments, and searches
+  across 21 platforms, including Douyin, Weibo, Xiaohongshu, and other CN platforms
+- **Compliance & KYB checks** — sanctions/PEP/adverse-media screening, company
+  registries worldwide, email & domain trust, trade data
+- **Onchain & prediction-market data** — crypto prices, wallet forensics, Polymarket/
+  Kalshi markets, Google Trends demand curves
+- **Public-record intelligence** — SEC filings (private fundraises, private-company
+  financials, insider trades), federal court dockets, nonprofit 990 financials, H-1B
+  salary disclosures — 1¢ per lookup, every answer linked to the official filing
 - plus storage, databases, hosting, AI tooling, document parsing, browser automation,
-  contact enrichment, embeddings, and more
+  contact enrichment, embeddings, and more — 1,200+ pay-per-call endpoints in all
 
@@ -131,2 +148,5 @@ **Recipes — pre-built, multi-step workflows that chain services into an outcome:**
   categories, traffic sources, GTM strategy, SEO footprint, and user research
+- **Public-record lookups** — "has this company raised?", private-company income
+  statements, litigation profiles, insider trades, nonprofit finances, real H-1B
+  salaries — answered from official filings, every claim linked to its source
 - **Find & enrich leads** — find prospects to connect with and enrich them across
@@ -133,0 +153,0 @@ multiple enrichment engines

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Fixed alerts

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Improved metrics

Total package byte prevSize

74149

5.77%

Lines of code

1288

5.75%

Worsened metrics

Number of low supply chain risk alerts

14

16.67%

Number of medium supply chain risk alerts

9

12.5%

No dependency changes