From eb1efcf9f833dc3bf5568134e9d5b3c3c7912e9c Mon Sep 17 00:00:00 2001
From: James Wampler <james@wamp.dev>
Date: Mon, 17 Aug 2026 18:39:56 -0700
Subject: [PATCH] Stop tracking .mcp.json; it carries a real API key
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

.mcp.json needs NOVELLY_API_KEY to match the API's Auth:ServiceApiKey
user secret, so it can't be a checked-in file — gitignore it and keep
.mcp.json.example (with the key blanked out) as the template. README
walks through copying the example and setting the matching user secret.
---
 .gitignore        |  1 +
 .mcp.json         | 11 -----------
 .mcp.json.example |  3 ++-
 README.md         | 14 ++++++++++----
 4 files changed, 13 insertions(+), 16 deletions(-)
 delete mode 100644 .mcp.json

diff --git a/.gitignore b/.gitignore
index d06f709..7302726 100644
--- a/.gitignore
+++ b/.gitignore
@@ -436,6 +436,7 @@ dist/
 *.db-shm
 *.db-wal
 mcp-server/
+.mcp.json
 
 # Toolchains installed locally by scripts/ci/lib.sh
 .dotnet/
diff --git a/.mcp.json b/.mcp.json
deleted file mode 100644
index c755c96..0000000
--- a/.mcp.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "mcpServers": {
-    "novelly": {
-      "command": "/home/james/src/novelly/mcp-server/Novelly.Mcp",
-      "env": {
-        "NOVELLY_API_URL": "http://localhost:5080",
-        "DOTNET_ROOT": "/home/james/.dotnet"
-      }
-    }
-  }
-}
diff --git a/.mcp.json.example b/.mcp.json.example
index 71f03a2..e6ebe4d 100644
--- a/.mcp.json.example
+++ b/.mcp.json.example
@@ -3,7 +3,8 @@
     "novelly": {
       "command": "./mcp-server/Novelly.Mcp",
       "env": {
-        "NOVELLY_API_URL": "http://localhost:5080"
+        "NOVELLY_API_URL": "http://localhost:5080",
+        "NOVELLY_API_KEY": "<matches the API's Auth:ServiceApiKey user secret>"
       }
     }
   }
diff --git a/README.md b/README.md
index 3fbab77..969a092 100644
--- a/README.md
+++ b/README.md
@@ -193,21 +193,27 @@ client spawns directly, so nothing rebuilds it automatically. Re-run the script
 reconnect your MCP client) after pulling changes that touch `src/Novelly.Mcp`, or it keeps
 serving whatever was published last, including against a stale auth contract.
 
-`.mcp.json` (or Claude Desktop's config):
+Copy `.mcp.json.example` to `.mcp.json` (gitignored, since it carries your API key) and
+fill in the key:
 
 ```jsonc
 {
   "mcpServers": {
     "novelly": {
       "command": "/absolute/path/to/mcp-server/Novelly.Mcp",
-      "env": { "NOVELLY_API_URL": "http://localhost:5080" }
+      "env": {
+        "NOVELLY_API_URL": "http://localhost:5080",
+        "NOVELLY_API_KEY": "<matches the API's Auth:ServiceApiKey user secret>"
+      }
     }
   }
 }
 ```
 
-The API must be running. If it is not, the tools say so in a message the model can act on
-rather than failing opaquely.
+The API must be running, with `Auth:ServiceApiKey` set (e.g. via
+`dotnet user-secrets set Auth:ServiceApiKey <key> -p src/Novelly.Api`) to the same value
+as `NOVELLY_API_KEY` above. If the API is not running, or the key is missing or mismatched,
+the tools say so in a message the model can act on rather than failing opaquely.
 
 ### Importing an existing outline