mirror of
https://github.com/chainbase-labs/Agentkey.git
synced 2026-09-20 14:20:23 +08:00
599caf0067fe80e5d0c9c8a4424998683aab5e2c
76 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 lxcong
|
599caf0067 |
chore(main): release 1.13.0 (#85)
🤖 I have created a release *beep* *boop* --- ## [1.13.0](https://github.com/chainbase-labs/Agentkey/compare/v1.12.1...v1.13.0) (2026-08-05) ### Features * improve Kimi plugin onboarding ([#86](https://github.com/chainbase-labs/Agentkey/issues/86)) ([v1.13.0 |
||
|
zzAllenn
|
db38a59d7b |
feat: improve Kimi plugin onboarding (#86)
## Summary - add a Kimi Code plugin manifest with an inline AgentKey MCP server definition - use Kimi's native MCP OAuth flow while keeping browser login explicit through `/mcp-config login plugin-agentkey:agentkey` - document the required `/reload`, browser authorization, local-plugin update flow, and legacy global MCP cleanup - include the Kimi manifest in release-please and version-sync checks - add regression coverage for the Kimi manifest shape and OAuth configuration ## Why Kimi requires `mcpServers` to be declared inline in the plugin manifest. The previous path-based configuration was not loaded as a plugin MCP server, so installation did not produce the expected MCP-aware reload guidance. With the corrected manifest, Kimi recognizes the MCP server during installation and shows its standard `/new` or `/reload` prompt. After reloading, the user completes Kimi's native browser OAuth flow explicitly with `/mcp-config login plugin-agentkey:agentkey`. ## User impact After installing the plugin, users receive the reload guidance from Kimi. They run `/reload`, follow Kimi's OAuth prompt with `/mcp-config login plugin-agentkey:agentkey`, approve the browser authorization, and can then use AgentKey normally. ## Validation - installed the local plugin with Kimi Code CLI 0.31.1 and confirmed the success screen reports one MCP server plus `Run /new or /reload to apply plugin changes.` - verified the managed Kimi plugin copy matches the repository manifest - validated the Kimi manifest shape and native-OAuth constraints - verified all six release version values remain synchronized at 1.12.1 - parsed the modified GitHub Actions workflows as YAML - ran `git diff --check` The repository CI runs the full Bats suite on Ubuntu and macOS. --------- Co-authored-by: Allen <0xfatdog@gmail.com> |
||
|
zzir
|
9891ed5dee |
feat(skill): rebuild discovery around find_tools (#84)
## Change Type
- [x] Routing logic change (`SKILL.md`)
## Description
The skill had drifted several server versions behind, to the point of
being
actively wrong:
- The execute examples still used the retired aggregate-dispatch model
(`agentkey_social` with a nested path, `agentkey_search` with
`type="news"`).
Those calls now 400 — `core.Lookup("news")` has no match. The whole
"Common
Calls" section was removed rather than repaired: `find_tools` is
accurate
enough that hardcoded no-discovery shortcuts are pure decay.
- Only 4 of the 9 categories were documented — finance, ecommerce,
business,
weather and travel were unreachable in practice.
- `agentkey_account` was listed as an MCP tool; it is
`execute_tool(name=…)`.
- The upstream-failure fallback the server sends in its own instructions
(sibling surface, sibling version, alternate provider) was missing.
Discovery is now a single `find_tools` path (`q=` / `prefix=` / both /
neither),
with `list_tools` marked deprecated. No concrete `Provider/Operation`
name
appears anywhere in the skill — names go stale, and a stale example
teaches a
name the model will later hallucinate.
`references/cost-aware.md` and `references/setup.md` are synced to
match.
> [!IMPORTANT]
> Depends on server-side `find_tools` `prefix=` support shipping first.
Please
> hold the merge until that is live, since merging cuts a release.
## Checklist
- [x] No knowledge added to `SKILL.md` (routing logic only)
- [x] Reference guides follow the existing structure
<sub>The "New social platform" / "New service or provider" sections
don't apply
and were removed. Heads-up: they reference `references/social/` and
`references/<category>/`, which no longer exist in this repo, and the
"standard structure" section they point to is absent from
`CONTRIBUTING.md`.</sub>
---
### Contributor Agreement
- [x] I confirm my contribution is licensed under the Apache License,
Version 2.0 (see [LICENSE](../LICENSE)).
|
||
|
lxcong
|
5f7c0f27f1 |
chore(main): release 1.12.1 (#77)
🤖 I have created a release *beep* *boop* --- ## [1.12.1](https://github.com/chainbase-labs/Agentkey/compare/v1.12.0...v1.12.1) (2026-07-24) ### Bug Fixes * **codex-plugin:** update default example prompts with concrete use cases ([#76](https://github.com/chainbase-labs/Agentkey/issues/76)) ([v1.12.1 |
||
|
lxcong
|
969c5c16d2 |
fix: remove purchase guidance from AgentKey skill (#79)
## Change Type - [x] Bug fix / content correction - [x] Routing logic change (`SKILL.md`) - [ ] New social platform - [ ] New service / provider - [ ] Onboarding / setup change - [ ] Docs / README ## Description - Replace subscription upgrade and billing links in insufficient-credit handling with a neutral stop message. - Explicitly prevent the skill from offering or linking plan upgrades, credit purchases, subscriptions, billing, checkout, or overage. - Keep credit-aware execution safeguards while removing USD and purchase-oriented guidance. ## Checklist **New social platform:** - [ ] `skills/agentkey/references/social/<platform>.md` created - [ ] Routing table in `social/overview.md` updated - [ ] Coverage table + directory tree in `README.md` updated **New service / provider:** - [ ] Reference guide created under `references/<category>/` - [ ] Category overview updated - [ ] `SKILL.md` Step 3 routing table updated (if new tool) - [ ] `README.md` updated **Any change:** - [x] No knowledge added to `SKILL.md` (routing logic only) - [x] Reference guides follow the standard structure (see `CONTRIBUTING.md`) ### Testing - `git diff --check` - version synchronization check - purchase-guidance content scan - `bats tests` (10 passed) --- ### Contributor Agreement - [x] I confirm my contribution is licensed under the Apache License, Version 2.0 (see [LICENSE](../LICENSE)). |
||
|
lxcong
|
683ad83310 |
fix(codex-plugin): update default example prompts with concrete use cases (#76)
## Summary - Replace the 3 generic `defaultPrompt` examples in `.codex-plugin/plugin.json` with 5 concrete, scenario-driven prompts (Reddit trend research, Instagram post analysis, NVIDIA earnings reaction via Yahoo Finance + Google News, Taobao/JD/1688 price comparison, trending GitHub repos) Supersedes #75 (stale head after rebase onto main). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
lxcong
|
e746e01e39 |
chore(main): release 1.12.0 (#74)
🤖 I have created a release *beep* *boop*
---
##
[1.12.0](https://github.com/chainbase-labs/Agentkey/compare/v1.11.0...v1.12.0)
(2026-07-17)
### Features
* **plugin:** add Codex plugin support
([#73](https://github.com/chainbase-labs/Agentkey/issues/73))
([
v1.12.0
|
||
|
lxcong
|
71331667a3 |
feat(plugin): add Codex plugin support (#73)
## Summary Ships this repo as a **Codex plugin**, alongside the existing Claude Code plugin and Skills-CLI paths. - **`.codex-plugin/plugin.json`** — Codex plugin manifest: bundles `skills/`, points `mcpServers` at `.codex-plugin/mcp.json`, and carries `interface` metadata for the install UI (fields calibrated against the official Notion/Figma plugins in `openai/plugins`). - **`.codex-plugin/mcp.json`** — remote-HTTP MCP entry for `https://api.agentkey.app/v1/mcp`, authenticated via **MCP OAuth (RFC 9728 discovery)**. Codex plugins have no `userConfig`/header-interpolation mechanism, so the Claude-style `${user_config.AGENTKEY_API_KEY}` injection can't be reused. - **`.agents/plugins/marketplace.json`** — the repo is its own Codex marketplace: `codex plugin marketplace add chainbase-labs/agentkey`, then install AgentKey from `/plugins`. - **`release-please-config.json`** — bumps the Codex manifest version in lockstep with the Claude one. - **`AGENTS.md`** — accurate agent-facing repo guidance mirroring `.claude/CLAUDE.md` (replaces a stale draft that predated `@agentkey/cli`). - **Description/keywords refresh** — both plugin manifests and the Claude marketplace entry now use the Product Hunt positioning ("one-stop live data marketplace for your agent") and cover the full category list (finance, e-commerce, business data, weather/maps, travel). - **README / README_zh** — document the Codex plugin install path. ## Why no `oauth_resource` The first local test failed at the Clerk authorize endpoint with `invalid_request: The request includes the parameter 'resource' more than once`. Root cause: the rmcp SDK already appends `resource=<server url>` to the authorization request automatically (RFC 8707), and Codex appends a configured `oauth_resource` as a *second* `resource` param without deduplication (`codex-rs/rmcp-client/src/perform_oauth_login.rs`). Clerk enforces RFC 6749's no-repeated-params rule. Since our server fully advertises RFC 9728 resource metadata, `type` + `url` alone is sufficient — discovery does the rest. Guardrails documented in `.claude/CLAUDE.md` / `AGENTS.md` checklists. ## Test plan - [x] All JSON manifests validate - [x] `codex plugin marketplace add <local path>` + install succeeds (Codex desktop) - [ ] OAuth sign-in completes end-to-end after `oauth_resource` removal (re-test pending) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
lxcong
|
a2309d9db6 |
docs(readme): add Product Hunt daily #1 top-post badge (#72)
Adds the Product Hunt **Top Post (Daily #1)** badge to the header badge block of both `README.md` and `docs/README_zh.md` (kept in sync per repo docs rules). Badge SVG verified reachable (HTTP 200). ## Change Type - [x] Docs / README ## Checklist **Any change:** - [x] No knowledge added to `SKILL.md` (routing logic only) --- ### Contributor Agreement - [x] I confirm my contribution is licensed under the Apache License, Version 2.0 (see [LICENSE](../LICENSE)). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
lxcong
|
98124892a2 |
docs(readme): replace broken Star History chart with sealed-token URL (#71)
Updated the Star History section with a new chart link. ## Change Type - [ ] New social platform - [ ] New service / provider - [ ] Bug fix / content correction - [ ] Routing logic change (`SKILL.md`) - [ ] Onboarding / setup change - [ ] Docs / README ## Description <!-- What does this PR add or fix? --> ## Checklist **New social platform:** - [ ] `skills/agentkey/references/social/<platform>.md` created - [ ] Routing table in `social/overview.md` updated - [ ] Coverage table + directory tree in `README.md` updated **New service / provider:** - [ ] Reference guide created under `references/<category>/` - [ ] Category overview updated - [ ] `SKILL.md` Step 3 routing table updated (if new tool) - [ ] `README.md` updated **Any change:** - [ ] No knowledge added to `SKILL.md` (routing logic only) - [ ] Reference guides follow the standard structure (see `CONTRIBUTING.md`) --- ### Contributor Agreement - [ ] I confirm my contribution is licensed under the Apache License, Version 2.0 (see [LICENSE](../LICENSE)). --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
lxcong
|
0c426e5b9d |
docs: update pricing model to subscription with metered overage (#70)
## Summary AgentKey has switched from pay-as-you-go top-ups to subscription-based billing (each plan includes a monthly credit allowance; usage beyond it is billed as metered overage). This PR updates all pricing-related content accordingly. No specific plan names or prices are hardcoded — docs point to agentkey.app / console.agentkey.app for current pricing. ## Changes - **README.md**: tagline "Top up and go" → "One subscription and go"; console link now says "manage your subscription"; pricing FAQ rewritten for subscription + overage - **docs/README_zh.md**: mirrored Chinese updates (一份订阅全部搞定 / 订阅 + 超额按量 FAQ) - **skills/agentkey/SKILL.md**: `Insufficient credits` error guidance now suggests upgrading the subscription instead of topping up - **skills/agentkey/references/cost-aware.md**: intro explains the subscription allowance model; over-allowance estimates now offer an explicit "proceed and accept overage" option; balance-check-failure message updated ## Notes - The live site (agentkey.app) still shows the old pay-as-you-go copy — it should be updated before/alongside this landing - Overage mechanics (auto vs opt-in, monthly reset) are phrased neutrally; adjust if the actual billing behaves differently 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
lxcong
|
60ff45d57e |
chore(main): release 1.11.0 (#69)
🤖 I have created a release *beep* *boop*
---
##
[1.11.0](https://github.com/chainbase-labs/Agentkey/compare/v1.10.0...v1.11.0)
(2026-07-06)
### Features
* **skill:** add e-commerce, business data, weather/maps, travel to
description
([#68](https://github.com/chainbase-labs/Agentkey/issues/68))
([
v1.11.0
|
||
|
lxcong
|
1ccf4337f1 |
feat(skill): add e-commerce, business data, weather/maps, travel to description (#68)
## Summary - Expand the `skills/agentkey/SKILL.md` frontmatter `description` trigger list with four new data categories: e-commerce product data, business/company data, weather & maps/geolocation, and travel (flights/hotels) - Helps agents route these query types to AgentKey instead of built-in WebSearch/WebFetch ## Notes - Description length is 613 characters, well within the 1024-character Agent Skills spec limit - No behavior change beyond skill triggering scope 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
MOGU :\'-"/
|
3bef036573 |
docs(readme): remove Pricing section, promote Finance/E-commerce/Business to supported (#67)
## What & why Two small README cleanups, applied to both `README.md` and `docs/README_zh.md` (kept in sync per repo convention): ### 1. Remove the Pricing section Pricing already lives on [agentkey.app](https://agentkey.app) and the [console](https://console.agentkey.app), where it's authoritative and easy to keep current. Duplicating a credit-cost table in the README just invites drift. Removed the section and its top-nav anchor in both languages. The "New here? Start on the web" section still points readers to the site for pricing details. ### 2. Promote Finance / E-commerce / Business into the capability table These three categories are now live in the AgentKey MCP catalog (`finance`, `ecommerce`, `business` top-level categories), so they no longer belong under **Planned**: - **Finance** — Alpha Vantage, Finnhub, Tushare, yfinance (quotes, technical indicators, company financials, earnings) - **E-commerce** — Amazon, Taobao, JD, 1688, Douyin, TikTok Shop, Dewu, Xianyu (listings, prices, reviews, best-sellers) - **Business** — Crunchbase (company, funding, investor, people data) They're added as capability rows matching the existing description-style table; **Maps & Weather** remains the only Planned item. ## Diff - 8 insertions, 30 deletions across the two README files. No structural/format changes — follows the existing capability-table style introduced for the dynamic provider catalog. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
lxcong
|
74e40a47b7 |
chore(main): release 1.10.0 (#65)
🤖 I have created a release *beep* *boop*
---
##
[1.10.0](https://github.com/chainbase-labs/Agentkey/compare/v1.9.1...v1.10.0)
(2026-06-29)
### Features
* **skill:** add OAuth-first setup, slim SKILL.md via progressive
disclosure ([#62](https://github.com/chainbase-labs/Agentkey/issues/62))
([
v1.10.0
|
||
|
lxcong
|
8bc275a20b |
feat(skill): add OAuth-first setup, slim SKILL.md via progressive disclosure (#62)
## What Two changes to the AgentKey skill, on top of one another: ### 1. Slim `SKILL.md` via progressive disclosure The high-frequency Query path stays in `SKILL.md`; the rarely-executed upgrade machinery moves to references that load only when needed. - **`SKILL.md`: 317 → ~127 lines.** Step 0 collapses from ~165 lines of inline version-check / upgrade / telemetry logic to a ~12-line preflight stub. - **New `references/maintenance.md`** — the full upgrade flow: beacon protocol contract, 4-option upgrade prompt (With-Bash / No-Bash branches), snooze + auto-upgrade persistence, `error_class` mapping, and all `upgrade_decision` / `upgrade_result` telemetry. Loads only on a version-mismatch signal. ### 2. OAuth-first Setup flow Now that the hosted MCP server supports **native MCP OAuth**, the Setup flow prefers OAuth and only falls back to an API key when needed: - **`SKILL.md` Setup section** rewritten — **try OAuth first** (register the remote URL `https://api.agentkey.app/v1/mcp` with *no key* and let the client run its own browser OAuth), **API key as fallback** (Console-minted key + `Authorization: Bearer`). Written client-agnostically: no longer hard-codes the `@agentkey/cli --auth-login` one-liner or singles out one agent. - **`references/setup.md`** restructured into "OAuth registration" (per-client examples) + "API-key fallback" sections. - **`SECURITY.md`** posture aligned — dropped the stale `--auth-login` references; MCP config is written by the client/agent on registration, and the only remaining npm egress is the `npx skills update agentkey` update command. ## Why Per Anthropic's `skill-creator` guidance, the `SKILL.md` body is loaded on **every** skill trigger. Previously ~53% of that body was upgrade/telemetry plumbing that fires <1% of the time. Moving that machinery behind a reference cuts ~60% of per-query context while keeping the upgrade flow 100% intact. The Setup rework lets OAuth-capable clients connect without minting or pasting an API key — fewer steps, no long-lived secret to store — while keeping the API-key path for clients that can't do MCP OAuth. ## Behavior - **Slim part:** pure reorganization — frontmatter `description` (the triggering mechanism) is byte-for-byte identical; protocol rules, upgrade options, persistence files, and telemetry shapes are preserved verbatim in `references/maintenance.md`. - **Setup part:** new preferred OAuth path; the previous API-key registration is preserved as the documented fallback. ## Verification - ✅ `verify-version-sync` logic: all versions consistent at `1.9.1`. - ✅ `bats tests/`: pass (update script untouched). - ✅ `npx skills add . --list`: skill discoverable, frontmatter parses. - ✅ No `--auth-login` references remain in `SKILL.md` / `references/setup.md` / `SECURITY.md`. ## Note on release type This branch now carries a `feat(skill):` commit (OAuth-first setup), so the PR title has been retitled to `feat(skill):` — squash-merging will cut a release via release-please. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
lxcong
|
09caea707e |
chore(main): release 1.9.1 (#61)
🤖 I have created a release *beep* *boop*
---
##
[1.9.1](https://github.com/chainbase-labs/Agentkey/compare/v1.9.0...v1.9.1)
(2026-06-26)
### Bug Fixes
* **plugin:** wire .mcp.json remote MCP server for plugin installs
([#60](https://github.com/chainbase-labs/Agentkey/issues/60))
([
v1.9.1
|
||
|
fullstackjam
|
e7dbae688a |
chore: remove unused check-mcp.sh diagnostic script (#63)
## What Deletes `skills/agentkey/scripts/check-mcp.sh` (92 lines) and updates every doc that referenced it. The script has shipped since the initial public release but is **dead code** — nothing in the skill's runtime ever invokes it. ## Why it's safe to remove (the receipts) `check-mcp.sh` was never wired into the skill: - **Never in SKILL.md, ever.** `git log -S check-mcp -- '*SKILL.md'` returns no commits across all history — the script has never been referenced by the skill's decision tree in any version. - **Superseded by a native check.** The skill verifies MCP health by calling the MCP `list_tools` endpoint directly (SKILL.md → "Status" / Step 0.C), not a shell script. Its three status codes (`MCP_OK` / `MCP_NO_KEY` / `MCP_NOT_CONFIGURED`) are consumed by nothing. - **Not in any runtime path.** No reference in CI (`scripts-test.yml`), the bats suite, `dev-smoke.sh`, `install.sh`/`install.ps1`, or `uninstall.sh`/`uninstall.ps1`. The only mentions were prose: SECURITY.md, the ClawScan note, the PR template, and directory-tree comments. (The companion `@agentkey/cli` is a separately-published npm package; it *writes* MCP config and has no reason to invoke a diagnostic bundled inside an already-installed skill.) ## What removing it buys - **Drops the skill's only `python3` dependency.** `check-mcp.sh` shelled out to `python3` to parse `~/.claude.json`; on a host without python3 it silently returned a false `MCP_NO_KEY`. The surviving `check-update.sh` is pure shell. - **Shrinks the on-disk read footprint to zero.** Post-removal the skill reads **no** agent config file and **no** `AGENTKEY_API_KEY` value from disk — it only talks to the MCP transport. SECURITY.md's "Files the skill reads or writes" table is updated to match. - **Removes a security-scanner false-positive surface.** The credential-read (`*_API_KEY*`) pattern in this script is precisely what required a dedicated SECURITY.md carve-out *and* a `--clawscan-note` item explaining "this is not credential exfiltration." Both are now unnecessary and removed. ## Doc updates (no dangling references left) - `SECURITY.md` — "two helper scripts" → "one"; removed the check-mcp.sh bullet and the `*_API_KEY*` scanner note; fixed the file table (the skill no longer reads `~/.claude.json` / `~/.env.local`; `~/.claude.json` re-characterized as CLI-written so the credential-handling reference stays accurate). - `.github/workflows/release-please.yml` — dropped item (3) from the ClawScan note. - `.github/PULL_REQUEST_TEMPLATE.md` — removed the obsolete "check-mcp.sh still works" checkbox. - `README.md` / `docs/README_zh.md` / `.claude/CLAUDE.md` — directory-tree comments. `grep -rn check-mcp` now returns nothing. ## Verification - ✅ `bats tests/` — all 10 pass (they cover the untouched `check-update.sh`). - ✅ `grep -rn 'check-mcp\|MCP_OK\|MCP_NO_KEY\|MCP_NOT_CONFIGURED\|env.local'` → zero hits. - ✅ `release-please.yml` still parses as valid YAML. ## Why `chore:` and not `fix:` Typed `chore:` deliberately so release-please does **not** cut a version bump / GitHub Release for an internal cleanup — a release would push a no-op plugin update to every user. No end-user runtime behavior changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
lxcong
|
4d3f87b951 |
ci: auto-publish skill to ClawHub on release tag (#59)
## What Adds a `publish-clawhub` job to `.github/workflows/release-please.yml` so that whenever release-please cuts a stable `vX.Y.Z` release, the skill is automatically published to ClawHub (`chainbase/agentkey`). ## How it works - **Trigger:** gated on `needs.release-please.outputs.release_created == 'true'` — the same gate as the existing `publish-skill-asset` job. Only fires for real stable releases (not plain commits, not pre-releases). - **Auth:** `clawhub login --no-browser --token "$CLAWHUB_TOKEN"` using the new `CLAWHUB_TOKEN` repo secret. - **CLI pinned** to `clawhub@0.18.0` for reproducible publishes. - **Version** derived from the release tag (`v1.9.0` → `1.9.0`). - **Changelog** auto-extracted from the matching `## [<version>]` section of `CHANGELOG.md` and passed via `--changelog`. - **ClawScan note** accurately describes expected behavior: remote HTTP MCP endpoint + read-only GitHub-release version check + local config inspection (no exfiltration). ## Required setup - Repo secret **`CLAWHUB_TOKEN`** (already added) — the token's account must have publish rights to the `chainbase` owner. ## Notes - Must merge to `main` to take effect (release-please runs from the default branch). - v1.9.0 was already published manually; this automates all future releases. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
lxcong
|
35eab21872 |
fix(plugin): wire .mcp.json remote MCP server for plugin installs (#60)
## Summary
- The repo already ships as a Claude Code plugin
(`.claude-plugin/plugin.json` + `marketplace.json`), but `.mcp.json` was
empty (`{ "mcpServers": {} }`), so installing the plugin registered
**no** MCP server — the skill loaded with no tools to call.
- Wire `.mcp.json` to register a `type: http` server at
`https://api.agentkey.app/v1/mcp`, injecting the API key via the
documented `${user_config.AGENTKEY_API_KEY}` interpolation (the manifest
already declares `userConfig.AGENTKEY_API_KEY`).
`${CLAUDE_PLUGIN_OPTION_*}` env vars only apply to stdio/subprocess
servers, not to an http server header.
- Correct the now-misleading `.mcp.json` guidance in
`.claude/CLAUDE.md`, and document the public marketplace install path
(`/plugin marketplace add chainbase-labs/agentkey`) in `README.md` +
`docs/README_zh.md`.
Scope: only `.mcp.json`, `.claude/CLAUDE.md`, `README.md`,
`docs/README_zh.md` (+28/-10). Version/release files untouched; the
`fix:` lets release-please cut 1.9.1 on merge.
## Test Plan
- [x] `claude plugin validate .` passes
- [x] Local end-to-end (isolated config): `claude plugin marketplace add
./` + `claude plugin install agentkey@agentkey --config
AGENTKEY_API_KEY=…` → `plugin:agentkey:agentkey … ✓ Connected`,
confirming `${user_config.*}` is interpolated into the auth header and
the server authenticates
- [x] `bats tests/` 10/10 pass
- [ ] Reviewer sanity-check of the 4-file diff
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
|
||
|
lxcong
|
347df01611 |
chore(main): release 1.9.0 (#58)
🤖 I have created a release *beep* *boop*
---
##
[1.9.0](https://github.com/chainbase-labs/Agentkey/compare/v1.8.0...v1.9.0)
(2026-05-29)
### Features
* **skill:** cost-aware batch workflow + agentkey_account in tools table
([#57](https://github.com/chainbase-labs/Agentkey/issues/57))
([
v1.9.0
|
||
|
Bruce
|
f6dbed1d63 |
feat(skill): cost-aware batch workflow + agentkey_account in tools table (#57)
## Summary Teaches the LLM the batch-confirmation workflow that PR chainbase-labs/AgentKey-Server#70 (\`describe_tool\` cost field) makes possible. **Trigger:** \`≥3 calls\` OR estimated cost \`≥10 credits\`. **Workflow:** \`describe_tool\` → read \`cost.credits_per_call\` → multiply by N → \`agentkey_account\` for balance → present plan + estimate + balance to user → wait for confirmation → execute. ## Layer separation - **SKILL.md (Layer 1)**: gained 5 lines total — one row in the MCP Tools table for \`agentkey_account\` (marked \"Free\" + graceful fallback note), one rule under Rules pointing to the reference, one clause in step 0.C clarifying the 4 core tools are required and \`account\` is optional. No long-form prose. - **\`references/cost-aware.md\` (Layer 2, new, ~870 tokens)**: full workflow — pre-batch checklist, how to read \`describe_tool\`'s cost field (three shapes: number+map, billing_note only, free), user-confirmation script, cost-saving moves (provider switch, probe-first, dedup, trim N), balance-check failure recovery. Lazy-loaded — the reference only enters the model's context when the trigger fires. ## Backwards compat - Old servers without \`agentkey_account\` exposed via MCP: 0.C does not gate Setup on its presence; the reference doc's "balance check failed" branch covers the case. - Existing 4-tool clients keep working unchanged. ## Test plan - [ ] Install the local branch (\`npx skills add .\`) and ask Claude something obviously bulk: "find 5 xiaohongshu creators in skincare and get each one's profile" — expect the agent to call \`describe_tool\`, then \`agentkey_account\`, then present the plan before executing. - [ ] Ask a one-shot lookup ("search for AI news"): expect the agent to skip the workflow per the "single call + ≤1 credit + no batch intent" carve-out in the reference. - [ ] Ask against a server without \`agentkey_account\`: expect the agent to proceed without setup-loop failures. ## Release No \`version.txt\` bump — release-please will pick up the \`feat:\` prefix and open the bump PR. Per repo CLAUDE.md, plugin updates trigger on GitHub Release publication, not on commits, so this lands quietly until the next cut. |
||
|
lxcong
|
ae0aa447c7 |
chore(main): release 1.8.0 (#55)
🤖 I have created a release *beep* *boop*
---
##
[1.8.0](https://github.com/chainbase-labs/Agentkey/compare/v1.7.2...v1.8.0)
(2026-05-22)
### Features
* **installer:** unify skill + MCP agent registration (16 agents)
([#41](https://github.com/chainbase-labs/Agentkey/issues/41))
([
v1.8.0
|
||
|
MOGU :\'-"/
|
6efe69d278 |
docs(readme): show capabilities instead of provider list (#56)
## Summary - Replace the per-provider table on the README homepage (both EN and 中文) with a 4-row capability overview: Web search / Web scraping / On-chain / Social & content. - Tell readers to call `find_tools` for the live provider list — the underlying catalog rotates too often to keep the README in sync, and the homepage doesn't need that level of detail. - Drop remaining Xiaohongshu / 小红书 mentions from both READMEs (homepage table, use-case row, and the Claude/ChatGPT FAQ row). Heads up: `小红书` / `xiaohongshu` is still present in `.claude-plugin/plugin.json` and `.claude-plugin/marketplace.json` (storefront copy), and in `skills/agentkey/SKILL.md` (agent routing aliases). Out of scope for this PR — happy to do a follow-up if we want the same scrub applied there. ## Test plan - [ ] GitHub renders the new capability table correctly on both `README.md` and `docs/README_zh.md` - [ ] No remaining `Xiaohongshu` / `小红书` strings in either README - [ ] EN ↔ 中文 anchor links still resolve Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
不白
|
83363014c4 |
feat(installer): unify skill + MCP agent registration (16 agents) (#41)
## Summary - Drive both `npx skills add -a` and `@agentkey/mcp --auth-login --only` from a single detected-agent list. MCP registration now follows the same per-host auto-detection that skill install already does, expanding MCP auto-registration from 3 clients to **16**. - Fix the longstanding `claude-code` marker bug: it included Claude Desktop's config dir, causing skills CLI to target a nonexistent Claude Code on Desktop-only machines. `claude-desktop` is now its own id (MCP-only) — passed to `--auth-login --only` but never to `skills add`. - Detect Claude Desktop via `/Applications/Claude.app` / `%LOCALAPPDATA%\AnthropicClaude` so "installed but never launched" still registers (Linux still requires the config dir). - New `scripts/dev-smoke.sh` — sandboxed 4-phase regression suite, 42 assertions, ~10s, never touches real `$HOME`. Run before any PR touching install/uninstall scripts. ## Depends on [chainbase-labs/AgentKey-Server#9](https://github.com/chainbase-labs/AgentKey-Server/pull/9) — adds `--only <ids>` to `@agentkey/mcp --auth-login`. Older CLI versions silently ignore the flag, so this PR is forward-compatible either way. ## Uninstaller (the bigger gap before this) The previous uninstaller only cleaned 3 config paths and only knew the `mcpServers.<name>` JSON shape. With 13 new agents using 4 different schema dialects, that left AgentKey configured everywhere after uninstall. - Expanded MCP cleanup to **14 JSON paths + codex TOML**, covering all 16 auto-registered agents - Schema-agnostic JSON scrub: walks the tree and drops dict keys whose name EXACTLY matches our server names. Handles `mcpServers.<name>` / `mcp.<name>` / `amp.mcpServers.<name>` / `projects.X.mcpServers.<name>` in one pass - Codex TOML splice via awk / PowerShell (no parser dep) — drops `[mcp_servers.agentkey]` + legacy quoted block, preserves sibling sections - `droid mcp remove` + `openclaw mcp unset` for CLI-registered agents - **Exact-match** server names (not substring) so user keys like `agentkey-helper` are preserved (regression test included in dev-smoke) ## Bugs fixed during review | Where | Bug | |---|---| | install.sh:487 | Unbound `$TARGETS` variable (renamed during refactor) — `set -u` would have made this fatal | | install.ps1 | `$SkillTargets.Count` used where `$AllTargets.Count` was meant — diverged from install.sh behavior | | install.sh | `--only claude-desktop` ran `skills add -a` with no filter, defeating the user's `--only` intent. Now correctly skips the skill step | | install.sh helpers | Leaked-scope loop vars (`_ids`, `_id`) — declared `local -a` | ## Test plan - [x] `scripts/dev-smoke.sh` — 42 passing / 0 failing (Phase 1 unit tests + Phase 2 installer + Phase 3 writer schemas + Phase 4 uninstaller w/ false-positive guard) - [x] `bash -n` clean for install.sh + uninstall.sh - [x] `--list-agents` correctly lists `claude-desktop` as a separate id - [x] `--only claude-desktop --skip-mcp --yes` walks the new "MCP-only, skip skill" branch - [x] Auto-detect path tested via `bash -x` trace under `set -u` (no unbound-variable explosion) - [x] Uninstaller decoy fixtures: `agentkey-helper`, `other-svr`, `[mcp_servers.other]`, `[unrelated_section]` all preserved after scrub - [ ] Windows: `install.ps1` / `uninstall.ps1` syntax-checked but not runtime-tested (no Windows box handy — happy to test if reviewer has one) --------- Co-authored-by: Bruce <bruce@checkabc.me> |
||
|
Bruce
|
4ff03c11f8 |
docs(skill): use new capability path in crypto example (#54)
## Summary
`agentkey_crypto` now dispatches by capability path (`market/quotes`,
`token/price`, …) instead of provider-prefixed type names (`cmc_quotes`,
`token_price`, …) after the server-side providerless rename. The
quickstart snippet in `SKILL.md` still showed the old `cmc_quotes`
example, which would 400 against the new server.
This PR updates that one example and switches it to the canonical
**nested params** envelope, which is the shape the catalog renders and
the shape the server forwards verbatim to upstreams.
```diff
- execute_tool(name="agentkey_crypto", params={type: "cmc_quotes", symbol: "BTC"})
+ execute_tool(name="agentkey_crypto", params={type: "market/quotes", params: {symbol: "BTC"}})
```
Pairs with chainbase-labs/AgentKey-Server#40 (the server rename). No
version bump needed — `docs:` prefix keeps release-please from cutting a
release.
Full migration table for callers:
`AgentKey-Server/docs/crypto-providerless-taxonomy.md`.
## Test plan
- [x] Snippet renders correctly in `SKILL.md`
- [ ] Verify against staging server after server PR merges
|
||
|
lxcong
|
9003a73f6f |
chore(main): release 1.7.2 (#53)
🤖 I have created a release *beep* *boop*
---
##
[1.7.2](https://github.com/chainbase-labs/Agentkey/compare/v1.7.1...v1.7.2)
(2026-05-15)
### Bug Fixes
* **install:** drop remote/local detection, always try browser
([#52](https://github.com/chainbase-labs/Agentkey/issues/52))
([
v1.7.2
|
||
|
lxcong
|
26d220c582 |
fix(install): drop remote/local detection, always try browser (#52)
## Summary
Installer was sniffing SSH env vars, `~/.openclaw`, and `\$DISPLAY` to
decide whether to pass `--no-browser` to `@agentkey/cli --auth-login`.
Inspecting the v1.0 CLI source confirms this was unnecessary:
```js
const { device_code, user_code, verification_uri, expires_in } = await res.json();
const authUrl = \`\${verification_uri}?code=\${user_code}\`;
console.log(\` Open this URL to authorize:\`); // ← always prints
console.log(\` \${authUrl}\`);
// ...
if (!noBrowser) { /* best-effort open() */ } // ← only this is gated
```
The CLI **always** prints the auth URL on stdout. `--no-browser` only
adds a terminal QR and skips the `open()`/`xdg-open()`/`start()`
attempt. The CLI's open-browser call is already best-effort — on a
headless host it silently no-ops.
So the installer-side heuristic was:
- **redundant** for the URL (CLI prints it either way)
- **harmful** when it mis-detected (local users on a headless tmux pane
or behind a mis-detected SSH session got the QR flow with no browser
attempt at all, even though their machine could have opened one)
This was the root cause of the reported "no browser pops up on \`curl …
| bash\`" symptom.
## Fix
Drop the heuristic. Always call \`npx -y @agentkey/cli --auth-login\`
(no \`--no-browser\`). The CLI tries \`open\` / \`xdg-open\` /
\`start\`; if that fails the user has the URL right there in the
terminal.
## Removed
- \`detect_remote()\` in \`scripts/install.sh\` / \`Test-RemoteInstall\`
in \`scripts/install.ps1\`
- \`--remote\` / \`--local\` / \`-Remote\` / \`-Local\` flags + their
mutually-exclusive guard + \`FORCE_REMOTE\` / \`FORCE_LOCAL\` state
- \`--no-browser\` passthrough to the CLI
- \"Installing over SSH, inside Docker, …\" details section in README.md
/ docs/README_zh.md — replaced with a one-line callout under the
advanced install options
- Synopsis / help / behavior copy mentioning the old detection logic
Net: **+24 / -174 lines**.
## Test plan
- [ ] On macOS / Linux desktop: \`curl -fsSL
https://agentkey.app/install.sh | bash\` — browser pops up; URL also
visible in terminal as a fallback
- [ ] In an SSH session: same one-liner — \`xdg-open\` no-ops on the
remote host (no harm), URL is right there in terminal; copy it to a
local browser to finish
- [ ] Windows PowerShell: \`irm https://agentkey.app/install.ps1 | iex\`
— \`start\` opens the default browser; URL also visible
- [ ] \`--skip-mcp\` still skips the auth step
- [ ] \`bash -n scripts/install.sh\` passes (verified)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: lxcong <lxcong@chainbase.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
lxcong
|
1aaea71c9a |
chore(main): release 1.7.1 (#51)
🤖 I have created a release *beep* *boop*
---
##
[1.7.1](https://github.com/chainbase-labs/Agentkey/compare/v1.7.0...v1.7.1)
(2026-05-15)
### Bug Fixes
* **install:** always run auth-login, drop stale already_authed check
([#50](https://github.com/chainbase-labs/Agentkey/issues/50))
([
v1.7.1
|
||
|
lxcong
|
658dfda00b |
fix(install): always run auth-login, drop stale already_authed check (#50)
## Summary The installer's "is AgentKey already configured?" heuristic went stale after #47 / v1.7.0 switched `--auth-login` from a stdio MCP block to a remote-HTTP one. The check still greps for `\"AGENTKEY_API_KEY\": \"ak_...\"` (the old env-shaped field) — but the new config writes `\"Authorization\": \"Bearer ak_...\"` inside `headers` instead. **Observed symptom**: a user with a residual stdio config from an earlier release sees > ✓ AgentKey is already configured in an MCP client config — skipping auth. …the installer exits successfully, but calling any AgentKey MCP tool errors out because the stdio runtime `@agentkey/mcp` is no longer used. The mirror failure also exists: users who **have** successfully re-authed into the new HTTP shape no longer match the regex and would get re-prompted on every installer run. ## Fix Delete the heuristic. `@agentkey/cli --auth-login` already knows whether the local token can be reused or a fresh device-code round-trip is needed — let the CLI decide instead of having the installer second-guess from on-disk shape. **Removed** - \`already_authed()\` in \`scripts/install.sh\` - \`Test-AlreadyAuthed\` in \`scripts/install.ps1\` - \`--force-mcp\` / \`-ForceMcp\` flags (no longer meaningful — auth always runs unless \`--skip-mcp\`) - \`--force-mcp\` documentation in README.md / docs/README_zh.md Net: **-57 / +10 lines** across the four files. ## Test plan - [ ] On a machine with a stale stdio-shaped \`~/.claude.json\` from a pre-1.7 install: \`curl -fsSL https://agentkey.app/install.sh | bash\` now actually re-runs auth-login and the MCP block becomes a working HTTP entry - [ ] On a fresh machine: install still completes auth in one device-code flow (no behavior change) - [ ] On a machine already on the new HTTP shape: re-running the installer still works and the CLI either reuses the token or prompts (CLI's call, not the installer's) - [ ] \`--skip-mcp\` continues to skip the auth step - [ ] \`bash -n scripts/install.sh\` passes (verified) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: lxcong <lxcong@chainbase.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
lxcong
|
4c9fbc9902 |
chore(main): release 1.7.0 (#49)
🤖 I have created a release *beep* *boop*
---
##
[1.7.0](https://github.com/chainbase-labs/Agentkey/compare/v1.6.1...v1.7.0)
(2026-05-15)
### Features
* rename @agentkey/mcp → @agentkey/cli in install scripts and docs
([#47](https://github.com/chainbase-labs/Agentkey/issues/47))
([
v1.7.0
|
||
|
Bruce
|
ab0dba7eb1 |
feat: rename @agentkey/mcp → @agentkey/cli in install scripts and docs (#47)
## Summary Companion change to [chainbase-labs/AgentKey-Server#32](https://github.com/chainbase-labs/AgentKey-Server/pull/32). The npm package has been renamed; this PR updates everything users actually see. **User-facing** - \`scripts/install.{sh,ps1}\`: \`MCP_PACKAGE\` / \`$McpPackage\` → \`CLI_PACKAGE\` / \`$CliPackage\` - \`scripts/uninstall.{sh,ps1}\`: sweep BOTH \`@agentkey/cli\` and \`@agentkey/mcp\` so users upgrading from v0.x get a clean uninstall - \`skills/agentkey/SKILL.md\`: setup command + manual-config JSON example - \`README.md\` + \`docs/README_zh.md\`: every \`npx @agentkey/mcp\` command + the manual-config JSON examples (switched from stale stdio shape to the remote-HTTP shape that \`--auth-login\` actually writes in v1.0) **Internal / protocol docs** - \`SECURITY.md\`: file/network audit tables - \`protocol/skill-meta-v1.md\`, \`docs/SERVER-IMPLEMENTATION.md\`: clarify the protocol partner is AgentKey-Server's hosted \`/v1/mcp\` endpoint, not a standalone npm package — these references were already misleading before the rename - \`.claude/CLAUDE.md\`: keep Claude-session guidance in sync \`CHANGELOG.md\` left untouched (release-please manages history). ## Sequencing Merge this PR **after** \`@agentkey/cli\` is published to npm — otherwise the install scripts here will reference a package that doesn't exist yet. Recommended order: 1. Merge [AgentKey-Server#32](https://github.com/chainbase-labs/AgentKey-Server/pull/32) 2. \`cd cli && npm publish\` (first \`@agentkey/cli\` release at \`1.0.0\`) 3. Merge this PR ## Test plan - [ ] Verify \`npx -y @agentkey/cli --auth-login\` works end-to-end after npm publish - [ ] Verify \`scripts/uninstall.sh\` on a machine with \`@agentkey/mcp\` globally installed cleans it up - [ ] Spot-check the rendered README on GitHub for any missed references |
||
|
lxcong
|
c519384174 |
chore(main): release 1.6.1 (#46)
🤖 I have created a release *beep* *boop*
---
##
[1.6.1](https://github.com/chainbase-labs/Agentkey/compare/v1.6.0...v1.6.1)
(2026-05-14)
### Bug Fixes
* **skill:** re-trigger release-please after
[#44](https://github.com/chainbase-labs/Agentkey/issues/44) parse error
([#45](https://github.com/chainbase-labs/Agentkey/issues/45))
([
v1.6.1
|
||
|
lxcong
|
3caa5c3786 |
fix(skill): re-trigger release-please after #44 parse error (#45)
## Why
PR #44 merged successfully (the SKILL.md telemetry fix is on `main`),
but release-please did not open a 1.6.1 release PR.
Looking at the workflow log of the post-merge run, the
conventional-commits
parser bailed on the squash-merge commit:
```
commit could not be parsed:
|
||
|
lxcong
|
6e8e5441d7 |
fix(skill): align telemetry dispatch and field name with server (#44)
## Summary PR #31 wired skill-side telemetry through two paths that don't actually connect, so zero usable events reach PostHog from a real LLM session. - **Bug 1 (dispatch path)**: SKILL.md told the LLM `execute_tool(name="agentkey_internal", params={...})`, but `agentkey_internal` is registered as a separate top-level MCP tool in `@agentkey/mcp` ≥0.3.10. `execute_tool`'s router only knows `agentkey_search / scrape / social / crypto`, so the call returned `tool not found` and SKILL.md's silent-fallback swallowed the error. - **Bug 2 (field name)**: Body wrapped properties under `props: {...}` but `internal/handler/telemetry_handler.go` decodes `Properties map[string]interface{} json:"properties"`. Mismatched tag → nil map → server substituted empty map → every business field stripped before reaching PostHog. Only posthog-go's auto-injected `$lib` / `$os` / `$ip` plus `agent: "unknown"` (from `NormalizeAgent("")`) survived. ## Evidence Direct call vs SKILL.md-shaped call, same distinct_id, minutes apart in PostHog (project `agentkey`): | body field name | PostHog record for `upgrade_decision` | |---|---| | `properties: {...}` ✅ | `from_version=1.5.0`, `to_version=1.6.0`, `choice=accept_once`, `agent=claude-code` — all fields | | `props: {...}` ❌ | All `None` | Sink / auth / posthog-go batching / 24h dedupe all confirmed fine. Bug surface is exactly the two items above. ## Changes SKILL.md only: - 6 dispatch sites: `execute_tool(name="agentkey_internal", params={...})` → `agentkey_internal({...})` - Body field: `props` → `properties` No change to `check-update.sh`, MCP forwarder, or server. Skill-only is the cheaper side to align: 1.6.0 just shipped and has no install base. Agent attribution (server falling back to `agent: "unknown"`) is left as a follow-up — needs cross-client identification logic. ## Test plan - [x] `bats tests/check-update.bats` — 10/10 still passing (script-level TELEMETRY emission unchanged) - [x] Manual end-to-end: directly invoke `agentkey_internal({path: "telemetry/event", params: {event: "upgrade_decision", properties: {...}}})` → confirmed all fields land in PostHog - [ ] Smoke after release: bump version, install fresh, trigger a real upgrade flow, verify PostHog receives populated `skill_loaded` / `upgrade_decision` / `upgrade_result` 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
lxcong
|
d884b8898f |
chore(main): release 1.6.0 (#43)
🤖 I have created a release *beep* *boop*
---
##
[1.6.0](https://github.com/chainbase-labs/Agentkey/compare/v1.5.0...v1.6.0)
(2026-05-14)
### Features
* agent install telemetry (skill side, spec §8.1)
([#31](https://github.com/chainbase-labs/Agentkey/issues/31))
([
v1.6.0
|
||
|
lxcong
|
f830f2947d |
feat: agent install telemetry (skill side, spec §8.1) (#31)
## Summary
Skill-side half of the agent-install telemetry rollout (spec §8.1).
`check-update.sh` emits `TELEMETRY ...` lines on stdout, SKILL.md parses
them and dispatches via MCP. Adds 3-layer opt-out (file / env /
installer flag — file path checked here), 24h client-side dedup, and a
bats test harness.
- `skills/agentkey/scripts/check-update.sh` — `emit_telemetry()` +
`auto_upgrade_flag()` helpers, opt-out checks, 7 emit calls at 5 exit
points, 24h heartbeat dedup keyed by `LOCAL_VERSION`. Includes Linux
`stat` order fix (`-c %Y` first, `-f %m` second — `-f` on Linux means
filesystem mountpoint, not mtime)
- `skills/agentkey/SKILL.md` — Step 0 instructions for parsing
`TELEMETRY` lines and dispatching via
`execute_tool(\"agentkey_internal\", {path:\"telemetry/event\", ...})`;
upgrade-flow each branch dispatches `upgrade_decision` /
`upgrade_result` with mapped choice values
- `tests/check-update.bats` + `tests/helpers.bash` — 10 contract tests
with isolated `\$HOME` / `\$TMPDIR` / mocked curl
- `.github/workflows/scripts-test.yml` — bats CI on ubuntu + macos
- `README.md` + `docs/README_zh.md` — FAQ replacement for the old
\"nothing to collect\" sentence, new FAQ entry \"How do I opt out of
telemetry?\" / \"我如何关闭遥测？\"
- `scripts/uninstall.sh` — adds Step 7b to clean `~/.config/agentkey/`
(telemetry-disabled, update-disabled, snooze state)
## Blocked on
**AgentKey-Server PR** that registers the
`agentkey_internal/telemetry/event` MCP tool (must be filtered out of
`list_tools` / `find_tools` so the LLM doesn't accidentally call it).
SKILL.md falls back silently when the tool doesn't exist, so this PR is
safe to merge first — but the telemetry signal isn't recorded until the
server side lands.
Spec §11 mandates server-first merge order to keep the agent-side debug
log clean.
## Test plan
- [x] `bats tests/check-update.bats` — 10/10 passing locally
- [x] E2E smoke (skill-side plan Task 8 steps 1-3, 5):
- Default emit on `up_to_date`
- `~/.config/agentkey/telemetry-disabled` early-return (no TELEMETRY
line)
- `AGENTKEY_TELEMETRY=0` env override
- 24h heartbeat dedup (2nd invocation within window does not re-emit)
- `uninstall.sh` Step 7b cleans `~/.config/agentkey/`
- [ ] **Manual** — open Claude Code, ask an AgentKey-routed query.
Verify SKILL.md silently swallows the missing `agentkey_internal` tool
error (server not shipped yet) and the actual query still completes
- [ ] Verify bats CI runs green on ubuntu + macos matrix
## Pre-existing bug surfaced during testing (not in this PR)
`check-update.sh` line 130-ish cache fast-path uses the same wrong `stat
-f %m ... || stat -c %Y` order. Same Linux bug as the one fixed here in
`emit_telemetry`. Worth a separate one-line fix PR.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: lxcong <lxcong@chainbase.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
lxcong
|
7611a50fe1 |
chore(main): release 1.5.0 (#42)
🤖 I have created a release *beep* *boop*
---
##
[1.5.0](https://github.com/chainbase-labs/Agentkey/compare/v1.4.0...v1.5.0)
(2026-05-14)
### Features
* agent install telemetry (installer side, spec §8.3)
([#30](https://github.com/chainbase-labs/Agentkey/issues/30))
([
v1.5.0
|
||
|
lxcong
|
2069e0ca42 |
feat: agent install telemetry (installer side, spec §8.3) (#30)
## Summary Installer-side half of the agent-install telemetry rollout (spec §8.3). Adds `--no-telemetry` opt-out, telemetry status banner, and 7-var env passthrough to `npx -y @agentkey/mcp --auth-login` so the server can capture `install_completed` with full install context. - `scripts/install.sh`: `--no-telemetry` flag, `compute_device_fingerprint()` helper, env exports immediately before the `--auth-login` invocation - `scripts/install.ps1`: PowerShell-mirror of the same — `-NoTelemetry`, SHA-256 fingerprint, `$env:AGENTKEY_*` exports ## Blocked on **AgentKey-Server PR** that consumes the 7 transparent env vars (`AGENTKEY_TELEMETRY`, `AGENTKEY_INSTALL_SOURCE`, `AGENTKEY_DETECTED_AGENTS`, `AGENTKEY_SELECTED_AGENTS`, `AGENTKEY_INSTALLER_FLAGS`, `AGENTKEY_DEVICE_FINGERPRINT` — plus implicit skill-version detection on the server side) and capture `install_completed`. Until that lands, the env passthrough goes to a process that does nothing with them — harmless, but the telemetry signal is incomplete. This PR can be merged independently — it does not break the existing installer flow either way. ## Test plan - [x] `bash -n scripts/install.sh` — syntactic check passes - [x] `bash scripts/install.sh --help` — `--no-telemetry` documented in Options - [x] `bash scripts/install.sh --list-agents` — early-return path unaffected - [x] `bash scripts/install.sh --no-telemetry --skip-skill --skip-mcp --yes` — creates `~/.config/agentkey/telemetry-disabled`, prints "Telemetry: disabled (--no-telemetry)" - [x] Pre-existing opt-out file recognized — prints "Telemetry: disabled (~/.config/agentkey/telemetry-disabled exists)" - [x] Default (no flag / no file) — prints "Telemetry: anonymous usage stats enabled (re-run with --no-telemetry to opt out)" - [x] `install.ps1` structural checks (line count, `\$NoTelemetry` references, single `param(...)` block, brace balance) - [ ] PowerShell parse on Windows runner (relies on existing windows-latest CI for any install.ps1-touching PR) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: lxcong <lxcong@chainbase.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
lxcong
|
d2bfb29a08 |
chore(main): release 1.4.0 (#40)
🤖 I have created a release *beep* *boop*
---
##
[1.4.0](https://github.com/chainbase-labs/Agentkey/compare/v1.3.1...v1.4.0)
(2026-05-12)
### Features
* server-beacon skill-update path for non-Bash clients
([#39](https://github.com/chainbase-labs/Agentkey/issues/39))
([
v1.4.0
|
||
|
不白
|
65fb2f8181 |
feat: server-beacon skill-update path for non-Bash clients (#39)
## Summary
Fixes the silent-update-failure mode where Claude Desktop (and any MCP
client without a Bash tool) gets stuck on whatever skill version shipped
at first install. On this developer's Desktop the skill had been frozen
at `0.1.2` since April — no upgrade ever fired.
Root cause is structural: SKILL.md Step 0's update check uses an inline
` ```bash ``` ` block. Claude Code executes it; Desktop reads it as
documentation. So the entire upgrade flow is dead code on Desktop. This
PR routes the version check through the MCP server instead (always-on,
available to every client), and tightens a couple of correctness bugs in
the existing install/uninstall path while we're here.
Companion PR: chainbase-labs/AgentKey-Server (server-side
`agentkey_skill_meta` tool).
## What's in here
1. **Protocol** (`protocol/skill-meta-v1.md` +
`skill-meta-v1.schema.json` + 4 fixtures) — versioned,
additive-evolution wire format for an MCP meta tool that returns
`{skill_version_latest, client_detected, update_command, update_doc_url,
…}`. Spec lives in this repo (single source of truth); server vendors a
copy and CI on both sides diffs them.
2. **SKILL.md** — Step 0 now has 0.A (beacon, cross-client) → 0.B
(inline bash, Code-only compat) → 0.C (MCP tool sanity check). Step B
branches every persistence option on whether Bash is available, with
explicit no-Bash fallback text that tells the user what didn't get saved
and the exact terminal command to persist it manually. Step C points the
non-shell fallback at GitHub Releases (we don't have a docs site).
3. **install/uninstall scripts** — `npx skills remove
chainbase-labs/agentkey` was the wrong invocation: the CLI takes the
skill name (`agentkey`), exits 0 on no-match, and made the uninstaller
falsely report success. Same class of silent-success bug in `install.sh`
when `git clone` fails mid-run. Both fixed; added post-install
filesystem verification.
4. **README / README_zh** — accurate per-client update story, including
a one-time bootstrap command for users currently stuck on a pre-1.4.0
skill on Desktop.
5. **CI** (`protocol-validate.yml`) — every fixture validates against
the schema, schema rejects 4 known-bad payloads (regression guard), spec
doc references every fixture (forces docs ↔ artifact sync).
6. **`docs/SERVER-IMPLEMENTATION.md`** — handoff doc for the server PR.
## How verified
- 4/4 fixtures pass schema; 4/4 bad payloads correctly rejected
- All cross-references in spec doc resolve
- `verify-version-sync` awk still extracts `1.3.0` from SKILL.md
frontmatter
- Companion server PR exercises the actual MCP handshake (initialize +
tools/list + tools/call); response is valid v1 JSON
- Real GitHub Releases fetch + ETag caching works on the server side
## Test plan
- [ ] CI green (`protocol-validate.yml` and `verify-version-sync.yml`
both pass)
- [ ] Companion server PR merged + new `@agentkey/mcp` published
- [ ] Release-please cuts `v1.4.0` from this branch
- [ ] On Claude Code: existing inline-bash Step 0 still fires for users
on `v1.3.x`; they get prompted to update normally
- [ ] On Claude Desktop with a pre-1.4.0 skill: user runs the README
bootstrap command once to land `v1.4.0`; from that point on, every
subsequent version is auto-discovered via the meta tool
- [ ] On Cursor / Codex: meta tool returns the `npx skills update -g
agentkey` recipe; user upgrades via shell
## Notes for the reviewer
- This is **additive**: Claude Code's existing inline-bash path is
unchanged, so no regression risk there. The protocol's
`protocol_version: 1` + immortal `update_doc_url` fallback make future
v2 servers safely degradable for v1 skills.
- Claude Desktop deliberately has no `update_command` recipe yet —
Desktop installs skills into a sandboxed `~/Library/Application
Support/Claude/local-agent-mode-sessions/skills-plugin/<UUID>/...` path
that no external CLI can reach, and we don't have a first-party
installer script. The skill rule's "no command → point at GitHub
Releases" fallback handles this until one exists. Adding a Desktop
recipe later is a non-breaking change (one row in the server's `RECIPES`
map).
|
||
|
MOGU :\'-"/
|
f05e501e42 |
chore(install): remove fallback MCP snippet hint (#38)
## Summary - The post-install summary printed an `If your agent is NOT Claude Code / Claude Desktop / Cursor` block with a manual MCP JSON snippet. By the time the user sees it, `@agentkey/mcp --auth-login` has already either auto-written the supported configs or surfaced its own error — so this block is ambiguous noise for the supported path, and the canonical fallback for unsupported agents already lives in `SKILL.md`'s Fallback section. - Removed the same block from `install.ps1` to keep the Bash and PowerShell installers in sync. ## Test plan - [ ] `bash scripts/install.sh` ends with `Next steps` → `Docs` → `Uninstall` (no fallback snippet block in between). - [ ] `pwsh scripts/install.ps1` shows the same trimmed summary on Windows. - [ ] Confirm `skills/agentkey/SKILL.md` still documents the manual-paste fallback for non-auto-targeted agents (no doc regression). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
lxcong
|
dc6f755649 |
chore(main): release 1.3.1 (#37)
🤖 I have created a release *beep* *boop*
---
##
[1.3.1](https://github.com/chainbase-labs/Agentkey/compare/v1.3.0...v1.3.1)
(2026-05-12)
### Bug Fixes
* **skill:** publish 1.3.1 with corrected npx skills update command
([#36](https://github.com/chainbase-labs/Agentkey/issues/36))
([
v1.3.1
|
||
|
lxcong
|
d4cfef6f89 |
fix(skill): publish 1.3.1 with corrected npx skills update command (#36)
## Summary - The actual file changes (correct `npx skills update agentkey` in SKILL.md / README / docs / SECURITY) merged via #34 with a `docs:` prefix, so release-please ignored it ("No user facing commits found"). PR #35 tried to force the release with a `Release-As:` footer in an empty commit, but the squash-merge folded the footer into a paragraph and release-please did not parse it. - This PR uses an empty `fix:` commit so the squash-merge lands on main as a `fix:` commit. release-please will then automatically open a Release PR for v1.3.1. ## Test plan - [ ] Merge this PR with **squash** (so the commit on main starts with `fix:`). - [ ] Confirm the next `release-please` workflow run opens a Release PR bumping `skills/agentkey/version.txt` to `1.3.1`. - [ ] After Release PR merges, confirm tag `v1.3.1`, GitHub Release, and `agentkey.skill` asset are published. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: lxcong <lxcong@chainbase.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
lxcong
|
eed28e6f44 |
chore: release 1.3.1 (#35)
## Summary - The `npx skills update` command fix from #34 was merged with a `docs:` prefix, which release-please ignores for version bumps. Use a `Release-As: 1.3.1` footer in an empty commit to force-trigger a patch release so users on stale installs get the corrected upgrade flow. ## Test plan - [ ] After merge, confirm release-please opens a Release PR bumping `skills/agentkey/version.txt` to `1.3.1` and updating CHANGELOG. - [ ] After Release PR merges, confirm tag `v1.3.1`, GitHub Release, and `agentkey.skill` asset are published. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: lxcong <lxcong@chainbase.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
lxcong
|
05b339b07b |
docs: fix npx skills update command syntax (#34)
## Summary - The Skills CLI registers AgentKey under the short name `agentkey`, so `npx skills update chainbase-labs/agentkey` does not match the installed skill. Replace it with `npx skills update agentkey` everywhere it appears in user-facing docs and SKILL.md upgrade flow. - Affected: `skills/agentkey/SKILL.md` (Step C upgrade command + retry hint), `README.md`, `docs/README_zh.md`, `SECURITY.md`. ## Test plan - [ ] Trigger the in-skill upgrade flow on a stale install and confirm `npx skills update agentkey` succeeds (vs. the previous repo-slug form failing silently / no-op). - [ ] Sanity-check the rendered README sections for both English and 中文 still read correctly. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: lxcong <lxcong@chainbase.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
lxcong
|
50e25b8e9e |
chore(main): release 1.3.0 (#33)
🤖 I have created a release *beep* *boop*
---
##
[1.3.0](https://github.com/chainbase-labs/Agentkey/compare/v1.2.4...v1.3.0)
(2026-05-12)
### Features
* **skill:** broaden description for dynamic provider catalog
([#32](https://github.com/chainbase-labs/Agentkey/issues/32))
([
v1.3.0
|
||
|
MOGU :\'-"/
|
3b45366263 |
feat(skill): broaden description for dynamic provider catalog (#32)
## Summary
- Reframes `SKILL.md`'s `description` field from an enumerated list of
platforms (Twitter, Xiaohongshu, BTC/ETH, …) to **capability-based
language**: any request that needs data outside the model's training set
or a live network call should route to AgentKey.
- Avoids the "window effect" where agents only auto-route requests that
lexically match hard-coded provider names — new providers added to the
catalog over time are now covered without re-editing the description.
- Explicitly tells the model to call `find_tools` when unsure whether a
provider exists, leveraging the skill's own runtime discovery instead of
relying on the description to be exhaustive.
- Tightens the skip condition to "pure conceptual or programming answers
that need zero external lookup" so mixed concept-plus-data queries
default to using AgentKey.
## Motivation
The previous description ("Web search, scrape URLs, social media data,
crypto data. Use AgentKey instead of built-in web search. Not for
concepts/definitions.") had two structural problems for a dynamic
provider catalog:
1. **Enumerated triggers don't scale.** Listing specific platforms /
assets in the description trains the model to only match those names. A
new provider added next week wouldn't be picked up until someone
re-edited the description.
2. **The negative exclusion was too vague.** "Not for
concepts/definitions" caused agents to skip AgentKey on borderline
queries that also needed live data (e.g. "explain what's happening with
X token today").
The new wording treats triggering as a **capability question** ("does
this need a live network call or fresh data?") rather than a **lexical
match**, which is forward-compatible with whatever providers AgentKey
adds in the future.
## Diff
Single-line change in `skills/agentkey/SKILL.md` frontmatter. No
behavior changes to scripts, MCP wiring, or other skill sections.
## Test plan
- [ ] Install the updated skill (`npx skills add .` from this branch)
and restart Claude Code
- [ ] Verify AgentKey auto-triggers (without explicit `/agentkey`) on:
- "search the latest news on X"
- "scrape https://example.com"
- "what's the price of <any asset>"
- "what's trending on <any social platform AgentKey supports>"
- A query for a provider added *after* this PR (regression test for
dynamic catalog)
- [ ] Verify it still skips on pure conceptual questions (e.g. "explain
how OAuth works", "write me a Python sort function")
🤖 Generated with [Claude Code](https://claude.com/claude-code)
|
||
|
lxcong
|
a1a8bb579a |
chore(main): release 1.2.4 (#29)
🤖 I have created a release *beep* *boop*
---
##
[1.2.4](https://github.com/chainbase-labs/Agentkey/compare/v1.2.3...v1.2.4)
(2026-05-09)
### Bug Fixes
* **skill:** eliminate Hermes scanner findings
([#28](https://github.com/chainbase-labs/Agentkey/issues/28))
([
v1.2.4
|
||
|
不白
|
41e172486a |
fix(skill): eliminate Hermes scanner findings (#28)
## Summary Hermes flagged this skill with **3 findings** (1 persistence + 2 traversal) that, combined with `community-source` status, produced a `BLOCKED` verdict requiring users to install with `--force`. None of the findings reflected actual risk — all stemmed from incidental code/doc patterns. This PR removes every match and adds CI to keep them gone. ## Changes ### A — Eliminate path traversal in `check-update.sh` - Drop `dirname(BASH_SOURCE)/..` resolution and `version.txt` read - Embed `LOCAL_VERSION` as a constant, synced by release-please via `extra-files` - Script now does **zero filesystem traversal** — no `..`, no `dirname`, no `CLAUDE_PLUGIN_ROOT` dependency ### B — Remove persistent file-path enumeration from `SKILL.md` - Replace explicit list of agent config paths (`~/.claude/settings.json`, `claude_desktop_config.json`, `~/.cursor/mcp.json`) with a neutral one-liner pointing to `SECURITY.md` - The CLI behavior is fully documented in `SECURITY.md` for transparency without triggering scanner heuristics ### C — Align `SECURITY.md` with new internals - Update the `check-update.sh` description to call out the new zero-traversal design ### Hardening (D1) — script becomes shellcheck-clean - `set -u` + `set -o pipefail`; explicit `|| true` on every intentional silent-failure path - Replace 3× awk fork-and-read on the snooze file with a single atomic `read -r` (closes a real cross-process race) - Same treatment for the cache file parse — also eliminates `echo $VAR | awk` injection surface - Cache `date +%s` once per run (`NOW`), shared by cache-age and snooze expiry math - Switch `LATEST_VERSION` validation from `echo | grep -qE` to `case` glob, matching how `LOCAL_VERSION` is validated - **Net**: ~half the forks per run, no silent failures, stricter validation ### Metadata (D2) — improve community-source traceability - `SKILL.md` frontmatter: add `author` / `homepage` / `repository` / `license` fields - Standard fields, ignored by clients that don't read them, but give scanners and reviewers a direct path to the publisher ### Release plumbing - `SKILL.md` frontmatter `version`: 1.0.0 → 1.2.3 (long-standing drift) and tagged with `# x-release-please-version` so release-please now syncs it - `release-please-config.json`: add `check-update.sh` and `SKILL.md` to `extra-files` - New workflow `.github/workflows/verify-version-sync.yml` asserts all four versions match on every relevant push/PR — catches the case where someone hand-edits one location and forgets the others `version.txt` remains the **single source of truth** that humans maintain. The other three locations (`plugin.json`, `SKILL.md` frontmatter, `check-update.sh`) are auto-synced derivatives. ## Test plan - [x] Local smoke-test of `check-update.sh` across 11 scenarios: - cold run, `UP_TO_DATE` cache hit, `UPGRADE_AVAILABLE` cache hit - snoozed (active / expired / long expired) - disabled file - corrupted binary cache - local-version-moved-on - All paths produce expected output; `set -u` catches no false positives - [x] `bash -n` syntax check passes - [x] All four version locations (`version.txt`, `plugin.json`, `SKILL.md` frontmatter, `check-update.sh`) verified to match at 1.2.3 - [x] `SKILL.md` YAML frontmatter parses correctly with the new fields - [ ] CI passes - [ ] Re-scan with Hermes confirms 0 findings (post-merge, after release tag) ## Notes for reviewer - All four version locations exist for distinct technical reasons — see `release-please-config.json` for the sync wiring. Maintainer cost remains exactly one place (`version.txt`, bumped automatically by release-please from conventional commits). - The `set -u` change is the most behavior-affecting — please review the `|| true` guards on `read -r` and `curl ... | grep | sed` carefully. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |