@tannerlinsley/skylight

Skylight

Intent

Use Skylight through Kody with credentials entered once in Kody. Read and manage the reverse-engineered API through the complete tool set in skylight-mcp 1.1.1, without a local server or tunnel. Enabling write support does not authorize any particular calendar or household change.

The package exposes all 114 upstream tools: 37 reads and 77 writes. This includes events, profiles and categories, colors and assignments, source calendars, chores and routines, lists, meals and recipes, rewards and points, task templates, albums and messages, photos and videos, AI draft generation and approval, devices, and settings.

Save skylightEmail and skylightPassword as Kody user secrets approved for app.ourskylight.com. Existing secrets continue to work. The package remains private.

Using it

Import the default export from kody:@tannerlinsley/skylight. Pass operation and args. Call operation tools with optional mode read/write or name for descriptions and JSON input schemas. Existing inventory and read operation calls are unchanged.

Writes return a no-network preview by default. Apply the exact same operation and args with top-level confirm:true and the returned previewToken. dryRun:true always previews. The token identifies the proposed arguments, it is not a provider idempotency key or proof of human approval. A write requires an explicit frameId when its schema is frame-scoped.

Show the exact objects and obtain explicit user approval before deletion. Generate a proposed change set before bulk edits. Clear-list calls require the reviewed item_ids and abort if the list has changed. Ordinary requested writes can be previewed and applied by the agent within the user's authorization.

Files and additional credentials

Photo/video upload, custom avatar upload, and photo event import accept file:{name,base64}, up to 20 MiB, instead of image_path. Kody cannot read files from the user's computer. File previews show filename, size and SHA-256, never the file contents. Uploads reuse upstream multipart S3 signing. Photo event import remains best-effort and unverified upstream.

Apple calendar linking requires its app-specific password in a Kody secret approved for app.ourskylight.com. Pass a secret placeholder, never plaintext credentials. The Skylight password is not an Apple app-specific password.

Verification and limits

Every writer is tested with a mock API for both no-network preview and confirmed dispatch. Confirmation mismatch, unknown fields, changed list membership, multipart avatar bytes and secret redaction are tested. Live checks use read-only health and write previews. No production writes were made to test this release.

API and account permissions still apply. The connected account is an approved viewer; the account-user-list endpoint returns 403. Individual writes may also be denied by Skylight. Source-inferred operations, including category reassignment on deletion, device album changes, message copying, and photo-to-event linking, are not claimed as live-verified here.

OAuth tokens stay in runtime memory and refresh through upstream code. Cold runtimes sign in using the stored credentials, so frequent cold starts may hit login limits. Do not store raw tokens in source or packageStorage. The undocumented API can change without notice. Do not blindly retry a timed-out write; inspect its result first to avoid duplicates.

Pin upstream updates, rerun npm test, publish through the Kody Git workflow, then verify package discovery, read authentication and no-network previews. Do not replace package history with packageSave. No Mac or tunnel is required.