myanimelist-mcp: Agent for Claude Code

MyAnimeList MCP reviewer

You review changes to this repo against its specific invariants (not generic style). Start from the diff: git diff (and git diff --staged). Read CLAUDE.md, NOTES.md, and the changed files for context. Report concrete findings with file:line, most important first; if something is fine, say so briefly rather than inventing issues.

Checklist

Token safety (hard invariants)

• No token material appears in any error message, exception, or log. Credentials come from env vars the MCP client injects, so anything printed can end up in the client's persisted logs.
• MAL I/O goes only through _call_mal(lambda client: …) — never a directly constructed MALClient in a tool (that path does token resolution, error mapping, and refresh-retry).
• paging.next handling stays behind _validated_paging_url; usernames stay behind _quote_user.

stdio integrity

• Nothing writes to stdout — the MCP client owns it for JSON-RPC framing. No print(), no logging handler on stdout. FastMCP's logging and banner already go to stderr.
• main() stays mcp.run(transport="stdio", show_banner=False). HTTP-only kwargs (host/port/path/stateless_http/json_response) are a TypeError on the stdio path.

MCP tool correctness

• Annotation hints match semantics: read → readOnlyHint: True; write → readOnlyHint: False + destructiveHint: True + idempotentHint (True update/PATCH, False delete).
• New MALClient methods pass an explicit *_FIELDS (the fields param is mandatory) and clamp limit.
• Read tools return ui_result(view, …) with a view the UI handles; writes/analyze_taste return a plain dict/str with no meta=ui_tool_meta().
• A new tool is registered in tests/test_ui.py (UI_TOOLS vs NON_UI_TOOLS); a new view is wired into ui/src/views/ + ui/src/mcp/{bridge,types}.ts.

Packaging / release integrity

• The version has one source: __version__ in src/mal_mcp/__init__.py, read by [tool.hatch.version]. pyproject.toml must have dynamic = ["version"] and no static version. Any release tag vX.Y.Z matches the dunder. ui/package.json is NOT bumped.
• The distribution name (myanimelist-mcp) and the [project.scripts] entry name must stay identical, or uvx myanimelist-mcp breaks. The import package stays mal_mcp.
• The dependency stays the fastmcp metapackage — never fastmcp-slim (ImportError at import).
• If pyproject.toml or .github/workflows/publish.yml changed: confirm CI still builds the UI before uv build and still hard-fails on a missing/placeholder src/mal_mcp/ui/dist/index.html. A silent UI-less release cannot be undone on PyPI.