fix: correct MCP auth docs and add the missing elnora-review skill

README.md

@@ -1,6 +1,6 @@
 # Elnora Plugins — AI-Powered Bioprotocol Generation
 
-The [Elnora AI Platform](https://elnora.ai) for generating, optimizing, and managing bioprotocols for wet-lab experiments. This marketplace provides a Claude Code plugin with 9 skills + an MCP server declaration.
+The [Elnora AI Platform](https://elnora.ai) for generating, optimizing, and managing bioprotocols for wet-lab experiments. This marketplace provides a Claude Code plugin with 10 skills + an MCP server declaration.
 
 ## Installation (Claude Code)
 
@@ -47,7 +47,7 @@ Prefer browser-based OAuth, or running without a CLI? Install the plugin alone.
 # Choose: Enable → elnora
 ```
 
-Plugin provides: 9 skills + MCP declaration. Say "Use Elnora to list projects" — Claude invokes MCP, triggers OAuth on first use, then cached. No CLI needed.
+Plugin provides: 10 skills + MCP declaration. Say "Use Elnora to list projects" — Claude invokes MCP, triggers OAuth on first use, then cached. No CLI needed.
 
 ### Path 3: Advanced — API key MCP (CI / skip OAuth)
 
@@ -123,8 +123,10 @@ https://mcp.elnora.ai/mcp
 
 The Elnora MCP server supports two authentication methods:
 
-- **OAuth 2.1** (recommended) — A browser popup opens automatically on first connection. No manual configuration required.
-- **API Key** — Pass a Bearer token in the Authorization header. Generate keys from your Elnora account settings.
+- **OAuth 2.1** — A browser popup opens automatically on first connection; no manual configuration. Best for interactive clients (Claude Code, Cursor, VS Code).
+- **API Key** — Generate a key at [platform.elnora.ai](https://platform.elnora.ai) and send it in a request header. Best for CI, scripts, and non-interactive clients. Use **either**:
+  - `X-API-Key: <your-key>` — the standard header, or
+  - `Authorization: Bearer <your-key>` — if your client only exposes a single bearer/token field.
 
 ## For coding agents
 
@@ -148,7 +150,8 @@ Running Codex, Cursor, Aider, Continue, Amp, Jules, or Roo? Two files are writte
 | `elnora-projects` | Create and manage projects, project members, and roles |
 | `elnora-tasks` | Create, update, search, and manage tasks and task messages |
 | `elnora-files` | Create, upload, download, version, and manage files and working copies |
-| `elnora-folders` | Create, rename, move, and delete project folders |
+| `elnora-folders` | Browse, create, rename, move, delete, and share Knowledge Base folders |
+| `elnora-review` | Approve or reject Knowledge Base auto-tidy proposals |
 | `elnora-search` | Search across files, tasks, and all resources in the platform |
 | `elnora-admin` | Manage API keys, audit logs, and administrative operations |
 | `elnora-agent` | Run scientific tools and literature lookups (PubMed, ArXiv, web search) via the cloud agent |

elnora/skills/elnora-review/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: elnora-review
+description: >
+  This skill should be used when the user asks to "review the knowledge base",
+  "list review items", "KB review queue", "approve a review item", "reject a
+  review item", "auto-tidy proposals", "pending KB changes", or any task
+  involving the Elnora Platform Knowledge Base review queue.
+---
+
+# Elnora Knowledge Base Review
+
+Approve or reject the auto-tidy proposals in the Knowledge Base review queue.
+When KB auto-tidy is enabled for an organization (see `orgs set-autotidy` in the
+`elnora-orgs` skill), the agent proposes folder/file renames, moves, archives,
+and tags; those land here for a human to approve before they are applied.
+
+## Tool Access
+
+Elnora is available via two methods. Use whichever is configured.
+
+**Option A — CLI via Bash (preferred)**
+
+Run commands via your Bash/Shell tool as `elnora <group> <action> ...`. Verify with `elnora --version`. CLI uses ~5× fewer tokens than MCP.
+
+**Option B — MCP tools (when CLI isn't installed)**
+
+Look for tools prefixed `mcp__elnora__` in your available tools. Call them with structured parameters. See the "MCP Tool Names" table below for the mapping.
+
+**If neither is available, tell the user to install one:**
+
+- CLI: `curl -fsSL https://cli.elnora.ai/install.sh | bash` (macOS/Linux)
+  or `irm https://cli.elnora.ai/install.ps1 | iex` (Windows)
+- MCP: `claude mcp add elnora --transport http --scope user https://mcp.elnora.ai/mcp`
+  then `/mcp` to authenticate.
+
+**Never fabricate tool names.** Valid commands are in the Commands section; their MCP equivalents are in the MCP Tool Names table.
+
+## Invocation
+
+```bash
+CLI="elnora"
+```
+
+## Commands
+
+### List the Review Queue
+
+```bash
+$CLI --compact review list                 # pending items (default)
+$CLI --compact review list --status all    # every state
+$CLI --compact review list --status applied
+$CLI --compact review list --status rejected
+```
+
+Each item has an `id` (the review item ID) and a proposed change (rename / move / archive / tag) on a target folder or file. `--status` is `pending` (default), `applied`, `rejected`, or `all`.
+
+### Approve an Item
+
+```bash
+$CLI --compact review approve <ITEM_ID>
+```
+
+Applies the proposed change **as you** — you must have write access to the target, or the approve is rejected.
+
+### Reject an Item
+
+```bash
+$CLI --compact review reject <ITEM_ID>
+```
+
+Records the item as rejected; no change is applied.
+
+## MCP Tool Names
+
+| CLI command | MCP tool name |
+|-------------|---------------|
+| `review list` | `elnora_review_list` |
+| `review approve` | `elnora_review_approve` |
+| `review reject` | `elnora_review_reject` |
+
+## Agent Recipes
+
+**Approve every pending rename, review everything else:**
+
+```bash
+$CLI --compact review list --status pending
+# inspect each item, then for the ones to accept:
+$CLI --compact review approve <ITEM_ID>
+```