fix: remove stale legal:write from api-keys scope list

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -18,7 +18,6 @@ Auth: `BETTERNEWS_API_KEY` env var, sent as `Authorization: Bearer` on every req
 | `src/tools/user.ts` | 7 user/profile tools |
 | `src/tools/moderation.ts` | 11 moderation tools |
 | `src/tools/tickets.ts` | 5 support ticket tools |
-| `src/tools/legal.ts` | 4 legal document tools |
 | `src/tools/blog.ts` | 7 blog tools |
 | `src/tools/api-keys.ts` | 4 API key tools |
 | `src/tools/sessions.ts` | 3 session tools |
@@ -118,15 +117,6 @@ Format: `tool_name` → file → `METHOD /api/route` → minimum auth
 | `reply_to_ticket` | `POST /api/tickets/{id}/reply` | `tickets:write` |
 | `update_ticket_status` | `PATCH /api/tickets/{id}/status` | `tickets:moderate` Mod/Admin |
 
-### Legal — `tools/legal.ts`
-
-| Tool | Route | Auth |
-| ---- | ----- | ---- |
-| `get_terms_of_service` | `GET /api/legal/current/terms_of_service` | public |
-| `get_privacy_policy` | `GET /api/legal/current/privacy_policy` | public |
-| `list_legal_documents` | `GET /api/legal` | optional; Mod/Admin see drafts |
-| `accept_legal_documents` | `POST /api/legal/accept` | User+ |
-
 ### Blog — `tools/blog.ts`
 
 | Tool | Route | Auth |

src/index.ts

@@ -8,7 +8,6 @@ import { registerSourceTools } from "./tools/sources.js";
 import { registerUserTools } from "./tools/user.js";
 import { registerModerationTools } from "./tools/moderation.js";
 import { registerTicketTools } from "./tools/tickets.js";
-import { registerLegalTools } from "./tools/legal.js";
 import { registerBlogTools } from "./tools/blog.js";
 import { registerApiKeyTools } from "./tools/api-keys.js";
 import { registerSessionTools } from "./tools/sessions.js";
@@ -37,7 +36,6 @@ registerSourceTools(server, client);
 registerUserTools(server, client);
 registerModerationTools(server, client);
 registerTicketTools(server, client);
-registerLegalTools(server, client);
 registerBlogTools(server, client);
 registerApiKeyTools(server, client);
 registerSessionTools(server, client);

src/tools/api-keys.ts

@@ -18,7 +18,6 @@ const SCOPES = [
     "mod:stats",
     "mod:users",
     "blog:write",
-    "legal:write",
     "user:profile",
     "user:apikeys",
     "privacy:read",

src/tools/legal.ts

@@ -1,51 +0,0 @@
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z } from "zod";
-import type { BetterNewsClient } from "../client.js";
-import { handleTool } from "../utils.js";
-
-export function registerLegalTools(server: McpServer, client: BetterNewsClient) {
-    server.tool(
-        "get_terms_of_service",
-        "Get the current published Terms of Service document.",
-        {},
-        handleTool(async () => {
-            const data = await client.get<unknown>("/api/legal/current/terms_of_service");
-            return JSON.stringify(data, null, 2);
-        }),
-    );
-
-    server.tool(
-        "get_privacy_policy",
-        "Get the current published Privacy Policy document.",
-        {},
-        handleTool(async () => {
-            const data = await client.get<unknown>("/api/legal/current/privacy_policy");
-            return JSON.stringify(data, null, 2);
-        }),
-    );
-
-    server.tool(
-        "list_legal_documents",
-        "List legal documents. Public sees published only; Mod/Admin see all.",
-        {
-            type: z.enum(["terms_of_service", "privacy_policy"]).optional().describe("Filter by document type"),
-            status: z.enum(["draft", "published", "archived"]).optional().describe("Filter by status (Mod/Admin only)"),
-            page: z.number().int().positive().optional().describe("Page number (default 1)"),
-            limit: z.number().int().min(1).max(50).optional().describe("Items per page (default 20)"),
-        },
-        handleTool(async (args) => {
-            const data = await client.get<unknown>("/api/legal", args);
-            return JSON.stringify(data, null, 2);
-        }),
-    );
-
-    server.tool(
-        "accept_legal_documents",
-        "Accept the current legal documents (Terms of Service and Privacy Policy). Clears the legalAcceptanceRequired flag.",
-        {},
-        handleTool(async () => {
-            const data = await client.post<unknown>("/api/legal/accept");
-            return JSON.stringify(data, null, 2);
-        }),
-    );
-}