Settings panel down from 26 fields to 8

The Configuration tab in Claude Desktop's Extensions UI used to expose 18 boolean toggles for individual capability groups (Records — Read, Records — Write, Inspections — Read, …) on top of the connection fields and master switches. Those toggles duplicated work that the host's Tool Permissions panel already does better — it groups tools by readOnly / destructive annotation, supports per-tool Allow / Ask / Deny, and respects user defaults. Two ways to enable / disable the same things made the install dialog confusing.

This release deletes the per-group toggles. The Configuration tab is now:

• Connection — App ID, App Secret, Agency, Environment, OAuth Redirect URI, Encryption Key (advanced)
• Master switches — Allow Write Tools, Allow Real-Money Payments

That's it. To pick which read tools Claude can call, use Settings → Extensions → Accela MCP → Tool Permissions.

How the master switch works now

ACCELA_WRITES_ENABLED is the single source of truth for write behavior:

Bundle users can flip the master back and forth from the Configuration tab without ever editing YAML. Restart the host after toggling so the tool list refreshes.

Removed

• 18 per-group user_config fields (group_records_read, group_records_write, ..., group_admin_escape_hatch).
• Their corresponding env-var wiring in manifest.json.
• ACCELA_GROUP_* handling in apply_env_overrides. Legacy bundles that still set these vars get them silently ignored.

Changed

• apply_env_overrides now only reads ACCELA_AGENCY, ACCELA_ENVIRONMENT, ACCELA_WRITES_ENABLED, and ACCELA_PAYMENTS_REAL_MONEY_ALLOWED.
• Allow Write Tools description rewritten to make the master-controls-everything semantics explicit.

CLI users

No effect. capabilities.yaml still works exactly as before. Only the bundle's user_config schema changed.

Upgrading

• Claude Desktop: download accela-mcp-0.5.0.mcpb below and drag onto the Extensions panel — replaces 0.4.3 in place. Existing App ID / Secret / Agency / Environment carry over. Any per-group toggles you'd set are ignored (their env vars are still set in the host config but the server no longer reads them).
• CLI: uv tool upgrade accela-mcp.

Tool permissions panel now groups Read-only and Write/delete

The Tool Permissions UI in Claude Desktop renders an MCP server's tools grouped by their readOnlyHint and destructiveHint annotations. Without those, every tool dumped into a single "Other tools" bucket — so users couldn't bulk-allow reads while keeping writes on Ask, and tool names were the raw accela_search_records form.

This release adds annotations + friendly titles to all 52 tools.

Changed

• Read-only tools (39) — discovery, all *_read tools, reference data, GIS, search, list reports, and accela_auth_status. Annotated readOnlyHint=true, destructiveHint=false, idempotentHint=true.
• Write/delete tools (13) — all *_write tools, admin escape hatch, run report, and accela_login. Annotated destructiveHint=true.
• Friendly titles on every tool (e.g. “Search Records” instead of accela_search_records) shown in the permissions UI alongside the toggle.
• accela_auth_status uses openWorldHint=false (reads only the local token store); everything else stays true.

Added

• read_only_annotations(title, *, open_world=True), destructive_annotations(title, *, idempotent=False), and auth_login_annotations(title) helpers in tools/_base.py. The destructive helper is named with the _annotations suffix to avoid a collision with accela_mcp.safety.write_tool — the existing dry-run / audit-log decorator that wraps each write tool's body.

Upgrading

• Claude Desktop: download accela-mcp-0.4.3.mcpb below and drag onto the Extensions panel — replaces 0.4.2 in place. After the bundle reloads, the Tool Permissions section splits into Read-only / Write/delete with the friendly titles.
• CLI: uv tool upgrade accela-mcp. Annotations are part of the MCP protocol payload; any host that respects them (Claude Desktop, recent Cursor builds) gets the grouping.

Settings panel grouped by section + new logo

The MCPB settings panel previously interleaved read and write toggles for each domain (Records — Read, Records — Write, Inspections — Read, Inspections — Write, ...) which made it hard to scan and easy to miss the master kill-switch. This release reorders the fields to mirror capabilities.yaml:

1. Connection — App ID, App Secret, Agency, Environment, OAuth Redirect URI, and Encryption Key (advanced).
2. Read tools — all default-on read groups: Records, Inspections, Documents, Property, People, Workflow, Fees, Reference Data, Global Search.
3. Write tools — Allow Write Tools (master switch) first, then the individual write groups (Records, Inspections, Documents, Workflow, Payments). Allow Real-Money Payments sits at the end of this section.
4. Specialty tools — Payments — Read, GIS, Reports, Admin Escape Hatch (all off by default).

Each description now leads with the section name (e.g. "Read tools — Search records, get record details...") so the grouping is visible on hosts that render fields as a flat list.

Defaults are unchanged and continue to match the enabled_groups shape of capabilities.yaml.

Changed

• manifest.json user_config field order grouped by section.
• bundle/icon.png replaced with a sharper Accela logomark (512 → 256). Used with permission.

Upgrading

• Claude Desktop: download accela-mcp-0.4.2.mcpb below and drag onto the Extensions panel — replaces 0.4.1 in place. Existing settings carry over; the new layout reorders fields without changing values.
• CLI: uv tool upgrade accela-mcp. No code changes vs 0.4.1.

Promote PyPI development status to Production/Stable

Metadata-only release. The project has shipped its stable feature surface — full v1 read catalog, v2 write groups, MCPB drag-drop bundle, in-chat auth recovery, and capability toggles in the host UI — with 351 tests across read/write/auth paths and end-to-end validation against live tenants. Beta no longer fits.

Changed

• Development Status :: 4 - Beta → 5 - Production/Stable
• Added classifiers: Intended Audience :: Information Technology, Operating System :: OS Independent, Topic :: Office/Business, Typing :: Typed, and Programming Language :: Python :: 3.13 (already covered by CI).

Upgrading

• Claude Desktop: accela-mcp-0.4.1.mcpb is functionally identical to 0.4.0; only upgrade if you want PyPI to show the new badge.
• CLI: uv tool upgrade accela-mcp.

Highlights

• Capability toggles in the host UI. The MCPB extension's settings panel now exposes Agency, Environment, a boolean toggle per capability group (Records — Read, Records — Write, Inspections — Read, …, Reports, Admin Escape Hatch), and the Allow Write Tools / Allow Real-Money Payments master kill-switches. No more dropping to a terminal to edit capabilities.yaml for a one-line change.
• MCPB UI is authoritative. A new apply_env_overrides layer in capabilities.py overlays these env vars on top of any loaded capabilities.yaml. CLI users who don't pass env vars see no change.
• Official Accela logo as the extension icon.

Added

• ~20 new user_config fields in manifest.json covering agency, environment, every non-always-on capability group, and the two write kill-switches.
• apply_env_overrides(config) in capabilities.py — reads ACCELA_AGENCY, ACCELA_ENVIRONMENT, ACCELA_GROUP_<NAME>, ACCELA_WRITES_ENABLED, and ACCELA_PAYMENTS_REAL_MONEY_ALLOWED and re-validates the merged config so cross-field rules (kill-switch, admin allowlist, payments friction) re-fire.
• env_group_var(group_id) helper that produces the canonical env-var name (records_write → ACCELA_GROUP_RECORDS_WRITE).
• accela_login now falls back to ACCELA_AGENCY / ACCELA_ENVIRONMENT env vars when neither an explicit arg nor a loaded config provides them — so MCPB users don't have to repeat values they already entered in the host UI when calling the tool from chat.
• 12 new tests covering the override layer, kill-switch validation under overrides, blank-string handling, and the auth env-var fallback.

Changed

• Friendly Title-Case labels on every existing user_config field (App ID, App Secret, OAuth Redirect URI, Encryption Key).
• bundle/icon.png replaced with the official Accela logomark (256×256). Used with permission.

Upgrading

• Claude Desktop: download accela-mcp-0.4.0.mcpb below and drag onto the Extensions panel — it replaces 0.3.1 in place. Existing settings (App ID, Secret, Redirect URI, encryption key) carry over; the new toggle defaults match the previous behavior so nothing turns on automatically.
• CLI: uv tool upgrade accela-mcp. No capabilities.yaml migration required.

How the new toggles interact with capabilities.yaml

If you set ACCELA_GROUP_REPORTS=true in the host UI, that group is enabled even if the YAML doesn't list it. If the YAML lists records_write but the UI flips Records — Write off, the group is dropped. The kill-switch validators still apply: enabling a *_write group without Allow Write Tools fails loud at startup with a clear error.

Bug fix release

Fixes a startup crash in the MCPB extension when a leftover tokens.json exists from a previous CLI install (e.g. accela-mcp setup was run before installing the bundle). The Fernet key on the bundle's auto-generated path doesn't match the key the old tokens were encrypted with, and build_context was only catching StartupError / RefreshTokenExpiredError — the RuntimeError from a decrypt failure crashed the subprocess before it could respond to the host's initialize handshake.

Now: undecryptable tokens route to bootstrap mode, the same as missing tokens. Run accela_login from chat and the new tokens overwrite the stale file.

Fixed

• build_context converts RuntimeError from TokenStore.load() into a StartupError, which serve_async already routes to bootstrap mode. Two regression tests cover both layers.

Workaround if you can't update yet

rm "/Users/<you>/Library/Application Support/accela-mcp/tokens.json"

Then restart the host app.

Upgrading

• Claude Desktop: download accela-mcp-0.3.1.mcpb below, drag onto the Extensions panel — it replaces the existing 0.3.0.
• CLI: uv tool upgrade accela-mcp.

Highlights

• Drag-drop install for Claude Desktop. Download the .mcpb artifact attached to this release, drag it into Settings → Extensions, fill in App ID + Secret in the config tab, then ask Claude “log me into Accela” — no terminal needed.
• In-chat auth recovery. Two new tools (accela_auth_status, accela_login) are always available, even when no tokens exist or the refresh window has expired. The OAuth flow runs from inside the MCP process.
• Auto-pagination on search tools. accela_search_records, accela_get_my_records, accela_search_addresses, accela_search_contacts, and accela_search_professionals now return up to 1000 results by default and surface a continuation cursor when more are available, so a year-long records query no longer silently stops at 100.

Added

• auth capability group (always-on) — accela_auth_status, accela_login. The login tool opens the browser, captures the OAuth redirect on a loopback listener, persists encrypted tokens, and auto-creates capabilities.yaml on first login.
• Bootstrap mode in serve_async — when tokens are missing or the refresh window has lapsed, the server registers only the auth tools instead of failing to start.
• ensure_mcp_key() auto-generates a Fernet encryption key on first run when the host passes an empty value, persisting it to the user-level env file (mode 0600 on Unix).
• 401-after-refresh API errors include a hint pointing at accela_login so the model can self-suggest the fix.
• manifest.json, bundle/server/launcher.py, bundle/icon.png, scripts/build-mcpb.sh, and .github/workflows/release-mcpb.yml so each Release attaches a packed .mcpb.
• auto_paginate=True (default) and max_results=1000 on the search tools, with a structured continuation cursor when capped. Set auto_paginate=False for the previous single-page behavior.
• auto_paginate_collect helper in api/pagination.py for tool authors.
• docs/INSTALL.md covering all four install paths (Claude Desktop drag-drop, accela-mcp setup CLI, manual Codex, manual Cursor / stdio).

Changed

• tools/_base.tool_call adds the login hint for status 401, alongside the existing EMSE hint for status 500.
• default_capabilities_yaml moved from cli.py into capabilities.py so the CLI and the in-chat login path share one default.

Install

• Claude Desktop: download accela-mcp-0.3.0.mcpb below and drag it into Settings → Extensions.
• CLI (Codex / Claude Desktop / Cursor): uv tool install accela-mcp then accela-mcp setup.

Full install walkthrough: docs/INSTALL.md.

Adds the v2 write groups (records_write, inspections_write, documents_write, workflow_write, payments_*, gis, reports) on top of the v1 read catalog. Every write tool is dry-run by default — a confirm=true argument is required to mutate Accela data, with multiple layers of safety gating confirmed calls.

Highlights

Safety scaffolding (accela_mcp.safety)

• WritePreview dataclass + write_tool decorator: every write tool defaults to dry-run and returns a structured preview describing method/path/body/summary/irreversible/affects_money. The LLM is instructed to surface the preview to the user before re-invoking with confirm=True.
• Append-only AuditLog (mode 0600 on Unix, JSON-line, redacts secrets and PII; falls back to stderr when no path configured).
• YAML cross-field validators that fail-loud at startup if a *_write group is enabled but writes.enabled: false, and that require an explicit i_understand_this_spends_real_money flag for PROD-like environments with payments.real_money_allowed: true.

New write tools (16 tools across 7 groups)

• records_write: create_record_partial, finalize_record, update_record (with expected_status precondition guard).
• inspections_write: schedule, reschedule, cancel, result, assign.
• documents_write: upload_document_to_record (multipart, 20 MB cap, binary stripped from preview).
• workflow_write: update_workflow_task.
• payments_read: list_record_payments.
• payments_write: initiate_payment, commit_payment (commit gated by payments.real_money_allowed beyond the master kill-switch).
• gis: geocode, reverse_geocode.
• reports: list_reports, run_report.

Other changes

• HTTP client: AccelaClient.request now accepts files=/data= for multipart uploads alongside the existing JSON path; retries and refresh apply uniformly.
• Discovery: accela_list_capabilities now reports tool names for every group, including the new write/payment/gis/reports groups.

Tests

• 300 unit tests passing (was 223 in v0.1.1); 77 new tests covering safety scaffolding, every write-tool dry-run path, every confirmed path, the kill-switch, the payments real-money gate, the expected_status precondition, multipart uploads, and the audit log format.
• ruff check + ruff format --check: both clean.

Safety guarantees in one sentence

For any write call to actually hit Accela, the LLM must invoke a write tool with confirm=True AND capabilities.yaml must have writes.enabled: true; for payments_write.commit, payments.real_money_allowed: true is also required, and PROD-like environments require an i_understand_this_spends_real_money flag on top of that.

Patch release focused on packaging and publishing polish.

Changes

• Bumped the package version to 0.1.1.
• Cleaned up the README install instructions now that accela-mcp is live on PyPI.
• Added the recommended uv tool install accela-mcp install path.
• Added uv tool upgrade accela-mcp for updates.
• Updated the TestPyPI workflow so reruns skip already-uploaded files instead of failing.

Install

uv tool install accela-mcp
accela-mcp setup

Initial PyPI release