fix: unblock anonymous /mcp, repair feature cards, correct demo schema - #24
Merged
Merged
Conversation
…correct demo schema The hosted endpoint advertises "free, no API key" everywhere (landing page, README, FAQ) but the auth middleware was returning 401 on /mcp in production for any request without a bearer token — so pasting https://mcp.shopdeals.sh/mcp into Claude / ChatGPT / Cursor surfaced a "weird error" instead of working. * Add `/mcp` and `/api` to the prod anonymous allowlist so the documented flow actually works. * Default `buildApp({ allowAnonymous })` to true; route-level gating in `isAnonymousAllowed` already constrains what anonymous can reach. * Key the global MCP rate limiter off the source IP for anonymous callers so the shared "anonymous" clientHash no longer collapses every free user into a single 60/min bucket. Landing-page UX: * Feature cards under "Built for AI agents" now expand from a click anywhere on the collapsed card (previously only the small header region was clickable). The CTA link still navigates once expanded. * The static `find_best_deal` example used args that don't exist on the real Zod schema (`maxPriceCents`, `applyCoupons`). Replaced with the actual surface (`query`, `alternatives`) and added a second tool call (`get_code_for_url`) so the demo shows a full multi-tool agent flow. README's "Example conversation" mirrors the corrected demo and gains a ready-to-paste prompt users can run against the live server.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
idanmann10
marked this pull request as ready for review
May 13, 2026 20:51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three bugs you flagged:
1. "When putting the URL into chat it gets a weird error"
The landing page, README, and FAQ all say "free, no API key, 60 calls/min per client" — but
authMiddlewarewas returning 401 unauthorized on/mcpin production for every request without a bearer token. Pastinghttps://mcp.shopdeals.sh/mcpinto Claude / ChatGPT / Cursor surfaced that 401 as a "weird error" instead of just working./mcpand/apito the prod anonymous allowlist (src/auth/anonymous.ts).buildApp({ allowAnonymous })now defaults totrue; the route-level allowlist already gates which paths anonymous can reach in prod, so the env-gated default was redundant and bug-prone.principal.clientHash, which is the literal string"anonymous"for every unauthenticated caller — meaning all free users shared one 60/min bucket. Anonymous traffic is now keyed offx-forwarded-for/cf-connecting-ip/x-real-ip, so each IP gets its own 60/min as advertised.2. "Built for AI agents — clicking a component doesn't auto-expand"
The click handler was only on
.fc-top(the tiny icon + pill strip at the top of each card). Clicking the title, body, or empty card area did nothing. Now the entire collapsed card is the click target; once expanded, the CTA link still navigates (we skip the expand handler when the target is an<a>or<button>inside an already-expanded card). The focus ring +cursor: pointermoved to the card itself.3. "Add a full AI prompt that works and test it"
While doing this I noticed the demo and README example called
find_best_dealwithmaxPriceCentsandapplyCoupons— neither field exists on the actual Zod schema ({ query, country?, alternatives? }). A real agent following that example would have failed validation.find_best_dealthenget_code_for_url— to show a full agent flow (compare sellers, then verify the winning coupon before recommending it).Test plan
npm run typecheckcleannpm run lintcleannpm test— all 166 tests pass (includingtest/auth/middleware.test.tsandtest/landing/landing.test.ts)https://mcp.shopdeals.sh/mcpinto Claude Desktop with no API key after deploy →tools/listsucceedshttps://claude.ai/code/session_01YFa2Xf6Bkw3rnR3DXeVtgj
Generated by Claude Code