2.6.1: discipline guard — public MCP build FAILS if it ever calls a gated path; soften sign-in desc

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Author: Geekur

README.md

@@ -64,7 +64,7 @@ _16 tools:_
 - `create_tournament_invite` — Create a shareable invite (QR/link) for an INDIVIDUAL tournament or round. Everyone who redeems the same invite joins the SAME event/session = the group, linked. max_uses caps the size (foursome=4). Requires OPENGOLFAPI_KEY.
 - `join_tournament` — Join a player into a tournament/round by redeeming its invite token. The player lands in the shared event = part of the field. Handicap is optional: gross by default (no handicap needed); if the player has one it auto-applies for net. Requires OPENGOLFAPI_KEY.
 - `request_sign_in_code` — Start "Sign in with OpenGolf" for a player: emails them a 6-digit code. No API key needed — the email authenticates them. They read you the code, then call complete_sign_in.
-- `complete_sign_in` — Finish "Sign in with OpenGolf": exchange the player's 6-digit code for their OpenGolf ID access token + portable player_id. Use the returned access_token as the X-OpenGolf-Token header to act AS the player — log scores, run/settle events you organize, grant awards (all scope-gated). scopes: space-separated, e.g. "identity events:settle awards:grant" (default "identity").
+- `complete_sign_in` — Finish "Sign in with OpenGolf": exchange the player's 6-digit code for their OpenGolf ID access token + portable player_id. Use the returned access_token as the X-OpenGolf-Token header to act AS the player, within whatever scopes you were granted. scopes: space-separated (default "identity").
 - `how_to_build` — The safe playbook for building on OpenGolfAPI and contributing data the right way. Call once before contributing.
 <!-- TOOLS:END -->
 

gen-manifest.mjs

@@ -17,6 +17,12 @@ const tools = [...src.matchAll(/server\.tool\(\s*'([a-z_]+)',\s*'((?:[^'\\]|\\.)
   .map((m) => ({ name: m[1], description: m[2].replace(/\\'/g, "'") }));
 if (!tools.length) { console.error('gen-manifest: found 0 tools — aborting (regex drift?)'); process.exit(1); }
 
+// CORE DISCIPLINE: nothing paid/gated/geo is ever public. Fail the build if the public MCP calls a gated
+// path (compute/events/awards/geo/ads/surface/settle/stats). The public MCP is the OPEN standard ONLY.
+const calls = [...src.matchAll(/api(?:Get|Post)[^(]*\(\s*[`'"]([^`'"]+)/g)].map((m) => m[1]);
+const gated = calls.filter((p) => /\/(compute|events|awards|geo|ads|surface)\b|settle|players\/[^/]*\/stats/.test(p));
+if (gated.length) { console.error('gen-manifest: PUBLIC MCP calls GATED paths — paid/gated must NEVER be public:', gated.join(', '), '\nAborting.'); process.exit(1); }
+
 // 1) server.json — keep version in sync (the official MCP registry schema is strict: no `tools` field,
 //    camelCase only). Tools live in the README (below) + are introspected from the package at runtime.
 const sjPath = join(dir, 'server.json');

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengolfapi/mcp-server",
-  "version": "2.6.0",
+  "version": "2.6.1",
   "description": "Golf for AI agents — every US course free, plus open contribution (OpenShot/Moments), portable identity & tournaments. The open data layer for golf.",
   "mcpName": "io.github.opengolfapi/mcp-server",
   "type": "module",

server.json

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.opengolfapi/mcp-server",
   "description": "Golf for AI agents — every US course free, plus open contribution, identity & tournaments.",
-  "version": "2.6.0",
+  "version": "2.6.1",
   "repository": {
     "url": "https://github.com/opengolfapi/mcp-server",
     "source": "github"
@@ -12,7 +12,7 @@
     {
       "registryType": "npm",
       "identifier": "@opengolfapi/mcp-server",
-      "version": "2.6.0",
+      "version": "2.6.1",
       "transport": {
         "type": "stdio"
       },

src/index.ts

@@ -578,7 +578,7 @@ server.tool(
 
 server.tool(
   'complete_sign_in',
-  'Finish "Sign in with OpenGolf": exchange the player\'s 6-digit code for their OpenGolf ID access token + portable player_id. Use the returned access_token as the X-OpenGolf-Token header to act AS the player — log scores, run/settle events you organize, grant awards (all scope-gated). scopes: space-separated, e.g. "identity events:settle awards:grant" (default "identity").',
+  'Finish "Sign in with OpenGolf": exchange the player\'s 6-digit code for their OpenGolf ID access token + portable player_id. Use the returned access_token as the X-OpenGolf-Token header to act AS the player, within whatever scopes you were granted. scopes: space-separated (default "identity").',
   {
     email: z.string(), code: z.string().describe('the 6-digit code from the email'),
     scopes: z.string().optional().describe('space-separated OAuth scopes (default "identity")'),