v0.3.0

Features

• describe_counter — read a counter's configuration — a new tool returns one counter's settings, goals, segments, filters, operations and grants, chosen with an include param. It finally exposes goal ids, so conversion metrics (ym:s:goal<id>reaches, …conversionRate) are buildable — previously reports could name goals but nothing surfaced their ids. get_metadata is slimmed to the global catalog plus the counter list.
• One-command browser sign-in — auth now opens the browser and catches the code automatically over a loopback redirect (http://127.0.0.1:53682/callback), so signing in is approve-and-done instead of copy-pasting the code Yandex shows. Still authorization-code + PKCE and secretless; falls back to the copy-paste flow when the local port can't bind or --oob is passed (YANDEX_OAUTH_LOOPBACK_PORT overrides the port).
• Sign in from the MCP client, no token file required — the server now boots unauthenticated instead of refusing to start when no token exists, and a new login / submit_code tool pair signs you in from inside the chat (loopback, with a copy-paste fallback). Data tools return an actionable "run login" prompt until you do — ideal for an installed-but-not-signed-in setup.
• One-click Claude Desktop install (.mcpb) — the server ships as a Desktop Extension alongside npx: bun run mcpb bundles it into a single tree-shaken file (~248 KB, no node_modules) with two optional config fields (a default counter id and a keychain-stored token), attached to each GitHub Release as a downloadable asset.

Internal / Dependencies

• Shared plumbing extracted to @boxlab/yandex-mcp-core — the OAuth/PKCE/loopback sign-in, the HTTP client, error mapping and the MCP result + login helpers now come from the shared @boxlab/yandex-mcp-core package instead of vendored copies, deduplicating them across the Yandex MCP family. No user-visible change: the same tools, env vars and token-cache path (~/.config/yandex-metrica-mcp/token.json) are unchanged.
• Least-privilege CI permissions — the CI workflow now declares permissions: contents: read instead of inheriting the repository default, resolving a CodeQL alert.
• A standalone MCP-registry publish workflow validates the manifests before the irreversible npm publish, so a bad manifest fails early rather than after npm has already gone out.
• Bump actions/setup-node to v7, actions/checkout to v7, and typescript-eslint in the dev group.

Docs

• README and tool docs for the new flows — documented the login / submit_code sign-in tools, describe_counter, loopback sign-in, and the one-click Desktop Extension install.

Full Changelog: v0.2.0...v0.3.0