@agentmanifest/mcp-server 0.0.0-stage → 0.1.2

package/README.md

@@ -1,3 +1,213 @@
-# Temporary Holding Version
+# Agent Manifest Protocol (AMP) — Official MCP Server
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![MCP](https://img.shields.io/badge/MCP-Model%20Context%20Protocol-6366f1)](https://modelcontextprotocol.io)
+[![AMP](https://img.shields.io/badge/AMP-v0.3-0ea5e9)](https://agent-manifest.com)
+
+Turn AMP’s **static web discovery** (`/.well-known/agent-manifest.json`) into **runtime MCP tools** so any LLM client (Claude Desktop, Cursor, Smithery, etc.) can discover APIs, validate manifests, and reason about legal/operational boundaries before calling them.
+
+## How AMP complements MCP
+
+| Layer | Role |
+| --- | --- |
+| **MCP** | Transport and tool surface between the model and your server |
+| **AMP** | Publisher-hosted manifest describing endpoints, auth, pricing/payment, rate limits, and `agent_notes` for autonomous agents |
+
+This server does **not** replace calling third-party APIs. It helps agents **decide whether and how** to call them in line with the publisher’s declared contract.
+
+## Tools
+
+### `fetch_manifest_by_domain`
+
+Fetches and parses a manifest from an API origin.
+
+**Input**
+
+```json
+{
+  "domain": "bakebase.agent-manifest.com"
+}
+```
+
+**Behavior**
+
+1. Normalizes the host (strips scheme/path).
+2. Tries, in order:
+   - `/.well-known/agent-manifest.json` (canonical, RFC 8615)
+   - `/.well-known/amp.json`
+   - `/agent-manifest.json`
+3. Returns `manifest`, `manifest_url`, `origin`, and `tried_urls`.
+
+### `validate_manifest_syntax`
+
+Validates JSON against the official AMP schema for `agentmanifest-0.2` or `agentmanifest-0.3`.
+
+**Input (object)**
+
+```json
+{
+  "manifest": {
+    "spec_version": "agentmanifest-0.3",
+    "name": "My API",
+    "...": "..."
+  }
+}
+```
+
+**Input (string)**
+
+```json
+{
+  "manifest": "{\"spec_version\":\"agentmanifest-0.3\",...}"
+}
+```
+
+**Output**
+
+- `valid: true` → `success_token` like `amp-schema-valid:agentmanifest-0.3:My API`
+- `valid: false` → `errors[]` with AJV paths/messages
+
+### `check_agent_permissions`
+
+Checks an intended HTTP operation against a manifest’s declared endpoints and constraints.
+
+**Input**
+
+```json
+{
+  "action": "POST /baking/validate-mix",
+  "manifest": { "...": "full manifest object from fetch_manifest_by_domain" },
+  "intends_unauthenticated": false,
+  "payment_onboarded": false
+}
+```
+
+**Output**
+
+- `verdict`: `compliant` | `violation` | `warning` | `unknown`
+- `findings[]`: structured codes (`endpoint_not_declared`, `auth_required`, `payment_onboarding`, `agent_notes_usage_restriction`, …)
+- `matched_endpoint` when a declared route matches (including `{id}` templates)
+
+## Install & run locally
+
+### Prerequisites
+
+- Node.js **18+**
+- Build the validator dependency once (local monorepo path):
+
+```bash
+cd agentmanifest/amp-mcp && npm install && npm run build
+# or from monorepo root:
+cd agentmanifest && npm install && npm run build --workspace=amp-mcp
+```
+
+### Stdio (Cursor, Claude Desktop, CI)
+
+```bash
+npx @agentmanifest/mcp-server
+# or after linking locally:
+node dist/index.js
+```
+
+### SSE HTTP hub (remote / agent-manifest.com)
+
+```bash
+PORT=8787 HOST=0.0.0.0 npm run start
+# GET  http://localhost:8787/mcp      — establish SSE stream
+# POST http://localhost:8787/messages?sessionId=... — JSON-RPC from client
+```
+
+Environment variables:
+
+| Variable | Default | Purpose |
+| --- | --- | --- |
+| `PORT` | `8787` | HTTP listen port |
+| `HOST` | `0.0.0.0` | Bind address |
+| `AMP_MCP_SSE_PATH` | `/mcp` | SSE endpoint |
+| `AMP_MCP_MESSAGES_PATH` | `/messages` | POST endpoint |
+| `AMP_ALLOWED_HOSTS` | `agent-manifest.com,...` | Host header allow list |
+| `AMP_FETCH_TIMEOUT_MS` | `15000` | Manifest fetch timeout |
+
+> **Note:** The MCP SDK marks legacy **HTTP+SSE** as deprecated in favor of Streamable HTTP. This package implements **SSE** as requested for broad client compatibility; you can add Streamable HTTP alongside later using `StreamableHTTPServerTransport`.
+
+## Claude Desktop configuration
+
+Add to `claude_desktop_config.json` (macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`):
+
+```json
+{
+  "mcpServers": {
+    "agent-manifest-protocol": {
+      "command": "node",
+      "args": ["/absolute/path/to/AMP/amp-mcp/dist/index.js"],
+      "env": {
+        "AMP_FETCH_TIMEOUT_MS": "15000"
+      }
+    }
+  }
+}
+```
+
+After publishing to npm, replace with:
+
+```json
+{
+  "mcpServers": {
+    "agent-manifest-protocol": {
+      "command": "npx",
+      "args": ["-y", "@agentmanifest/mcp-server"]
+    }
+  }
+}
+```
+
+## Cursor
+
+**Settings → MCP → Add server → Command:**
+
+- Command: `node`
+- Args: `/path/to/amp-mcp/dist/index.js`
+
+Or use `npx -y @agentmanifest/mcp-server` once published.
+
+## Smithery
+
+This repo includes [`smithery.yaml`](./smithery.yaml) for one-command Smithery installs. Point Smithery at this package directory or published GitHub repo; optional env:
+
+- `AMP_FETCH_TIMEOUT_MS`
+- `AMP_VALIDATOR_URL` (reserved for future remote validation helpers)
+
+## Registries (official MCP Registry, Smithery, npm)
+
+Docs: **[REGISTRY.md](./REGISTRY.md)** and **[modelcontextprotocol.io/registry/about](https://modelcontextprotocol.io/registry/about)**.
+
+The MCP Registry holds **metadata** (`server.json`); npm holds the package; Railway holds the remote URL. Host apps often discover you via **aggregators** that sync the registry — not by scraping your site.
+
+```bash
+brew install mcp-publisher   # see registry quickstart
+cd amp-mcp
+# package.json mcpName must match server.json "name"
+mcp-publisher login github   # or DNS/HTTP for com.agent-manifest/*
+mcp-publisher publish
+```
+
+## Development
+
+```bash
+npm run dev          # SSE server with tsx watch
+npm run dev:stdio    # stdio server
+npm test
+```
+
+## Architecture
+
+```mermaid
+flowchart LR
+  LLM[LLM Client] -->|stdio or SSE| MCP[AMP MCP Server]
+  MCP -->|HTTPS GET| Origin["API origin /.well-known/agent-manifest.json"]
+  MCP -->|AJV| Schema[AMP JSON Schema v0.2/v0.3]
+  MCP -->|rules engine| Perms[check_agent_permissions]
+```
+
+## License
+
+MIT © Agent Manifest Protocol

package/dist/create-server.d.ts

@@ -0,0 +1,3 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function createAmpMcpServer(): McpServer;
+//# sourceMappingURL=create-server.d.ts.map

package/dist/create-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-server.d.ts","sourceRoot":"","sources":["../src/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAWpE,wBAAgB,kBAAkB,IAAI,SAAS,CAiH9C"}

package/dist/create-server.js

@@ -0,0 +1,95 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import * as z from 'zod';
+import { fetchManifestByDomain } from './lib/fetch-manifest.js';
+import { validateManifestSyntax } from './lib/validate-syntax.js';
+import { checkAgentPermissions } from './lib/check-permissions.js';
+const manifestObjectSchema = z
+    .record(z.unknown())
+    .describe('Parsed AMP manifest object (agentmanifest-0.2 or agentmanifest-0.3).');
+export function createAmpMcpServer() {
+    const server = new McpServer({
+        name: 'agent-manifest-protocol',
+        version: '0.1.0',
+    }, {
+        instructions: [
+            'You are connected to the official Agent Manifest Protocol (AMP) MCP server.',
+            'Use fetch_manifest_by_domain to discover /.well-known/agent-manifest.json (and fallbacks) for any API origin.',
+            'Use validate_manifest_syntax before trusting manifest JSON.',
+            'Use check_agent_permissions before calling an API operation to see if it matches declared endpoints, auth, payment, and agent_notes constraints.',
+            'AMP complements MCP: MCP carries tools; AMP declares what remote agents/APIs allow, cost, and how to authenticate.',
+        ].join(' '),
+    });
+    server.registerTool('fetch_manifest_by_domain', {
+        title: 'Fetch AMP manifest by domain',
+        description: 'Resolve an API origin from a domain (e.g. "bakebase.agent-manifest.com"), try standard AMP discovery URLs, and return parsed manifest JSON plus metadata.',
+        inputSchema: {
+            domain: z
+                .string()
+                .min(1)
+                .describe('API hostname or URL origin without a path, e.g. "example.com", "api.example.com", or "https://bakebase.agent-manifest.com".'),
+        },
+    }, async ({ domain }) => {
+        const result = await fetchManifestByDomain(domain);
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    });
+    server.registerTool('validate_manifest_syntax', {
+        title: 'Validate AMP manifest JSON Schema',
+        description: 'Validate a manifest JSON string or object against the official AMP JSON Schema for its spec_version (agentmanifest-0.2 or agentmanifest-0.3). Returns errors or a success_token.',
+        inputSchema: {
+            manifest: z
+                .union([z.string(), manifestObjectSchema])
+                .describe('Either a JSON string of the manifest, or a parsed manifest object with spec_version, name, endpoints, etc.'),
+        },
+    }, async ({ manifest }) => {
+        const result = validateManifestSyntax(manifest);
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    });
+    server.registerTool('check_agent_permissions', {
+        title: 'Check action against AMP manifest constraints',
+        description: 'Given an intended HTTP action (method + path or full URL) and a manifest, determine whether the action aligns with declared endpoints, authentication, payment onboarding, rate limits, and language in agent_notes.',
+        inputSchema: {
+            action: z
+                .string()
+                .min(1)
+                .describe('Intended operation, e.g. "POST /baking/validate-mix", "GET /health", or "POST https://api.example.com/v1/search".'),
+            manifest: manifestObjectSchema,
+            intends_unauthenticated: z
+                .boolean()
+                .optional()
+                .describe('Set true if the agent plans to call the API without credentials.'),
+            payment_onboarded: z
+                .boolean()
+                .optional()
+                .describe('Set true if AMP payment onboarding is already complete for this API.'),
+        },
+    }, async ({ action, manifest, intends_unauthenticated, payment_onboarded }) => {
+        const result = checkAgentPermissions(action, manifest, {
+            intends_unauthenticated,
+            payment_onboarded,
+        });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    });
+    return server;
+}
+//# sourceMappingURL=create-server.js.map

package/dist/create-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-server.js","sourceRoot":"","sources":["../src/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;KACnB,QAAQ,CAAC,sEAAsE,CAAC,CAAC;AAEpF,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;QACE,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,OAAO;KACjB,EACD;QACE,YAAY,EAAE;YACZ,6EAA6E;YAC7E,+GAA+G;YAC/G,6DAA6D;YAC7D,kJAAkJ;YAClJ,oHAAoH;SACrH,CAAC,IAAI,CAAC,GAAG,CAAC;KACZ,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,2JAA2J;QAC7J,WAAW,EAAE;YACX,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,CACP,6HAA6H,CAC9H;SACJ;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EACT,kLAAkL;QACpL,WAAW,EAAE;YACX,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC;iBACzC,QAAQ,CACP,4GAA4G,CAC7G;SACJ;KACF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAA4C,CAAC,CAAC;QACpF,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,KAAK,EAAE,+CAA+C;QACtD,WAAW,EACT,sNAAsN;QACxN,WAAW,EAAE;YACX,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,CACP,mHAAmH,CACpH;YACH,QAAQ,EAAE,oBAAoB;YAC9B,uBAAuB,EAAE,CAAC;iBACvB,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,kEAAkE,CAAC;YAC/E,iBAAiB,EAAE,CAAC;iBACjB,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,sEAAsE,CAAC;SACpF;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,EAAE,EAAE;QACzE,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,QAAuB,EAAE;YACpE,uBAAuB;YACvB,iBAAiB;SAClB,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":""}

package/dist/http.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+import { createMcpExpressApp } from '@modelcontextprotocol/sdk/server/express.js';
+import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
+import { createAmpMcpServer } from './create-server.js';
+const MCP_SSE_PATH = process.env.AMP_MCP_SSE_PATH ?? '/mcp';
+const MCP_MESSAGES_PATH = process.env.AMP_MCP_MESSAGES_PATH ?? '/messages';
+const PORT = Number.parseInt(process.env.PORT ?? '8787', 10);
+const HOST = process.env.HOST ?? '0.0.0.0';
+const ALLOWED_HOSTS = process.env.AMP_ALLOWED_HOSTS
+    ? process.env.AMP_ALLOWED_HOSTS.split(',').map((h) => h.trim()).filter(Boolean)
+    : ['agent-manifest.com', 'www.agent-manifest.com', 'localhost', '127.0.0.1'];
+const transports = {};
+const app = createMcpExpressApp({
+    host: HOST,
+    allowedHosts: ALLOWED_HOSTS,
+});
+app.get('/health', (_req, res) => {
+    res.json({ ok: true, service: 'amp-mcp', transport: 'sse' });
+});
+app.get(MCP_SSE_PATH, async (req, res) => {
+    try {
+        const transport = new SSEServerTransport(MCP_MESSAGES_PATH, res);
+        const sessionId = transport.sessionId;
+        transports[sessionId] = transport;
+        transport.onclose = () => {
+            delete transports[sessionId];
+        };
+        const server = createAmpMcpServer();
+        await server.connect(transport);
+    }
+    catch (error) {
+        console.error('SSE connection error:', error);
+        if (!res.headersSent) {
+            res.status(500).send('Failed to establish SSE stream');
+        }
+    }
+});
+app.post(MCP_MESSAGES_PATH, async (req, res) => {
+    const sessionId = req.query.sessionId;
+    if (typeof sessionId !== 'string' || !sessionId) {
+        res.status(400).send('Missing sessionId query parameter');
+        return;
+    }
+    const transport = transports[sessionId];
+    if (!transport) {
+        res.status(404).send('Unknown session');
+        return;
+    }
+    try {
+        await transport.handlePostMessage(req, res, req.body);
+    }
+    catch (error) {
+        console.error('Message handling error:', error);
+        if (!res.headersSent) {
+            res.status(500).send('Error handling MCP message');
+        }
+    }
+});
+app.listen(PORT, HOST, () => {
+    console.log(`AMP MCP (SSE) listening on http://${HOST}:${PORT} — SSE GET ${MCP_SSE_PATH}, POST ${MCP_MESSAGES_PATH}`);
+});
+process.on('SIGINT', async () => {
+    for (const id of Object.keys(transports)) {
+        try {
+            await transports[id].close();
+        }
+        catch {
+            /* ignore */
+        }
+        delete transports[id];
+    }
+    process.exit(0);
+});
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC;AAC5D,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,WAAW,CAAC;AAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS,CAAC;AAC3C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB;IACjD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAC/E,CAAC,CAAC,CAAC,oBAAoB,EAAE,wBAAwB,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAE/E,MAAM,UAAU,GAAuC,EAAE,CAAC;AAE1D,MAAM,GAAG,GAAG,mBAAmB,CAAC;IAC9B,IAAI,EAAE,IAAI;IACV,YAAY,EAAE,aAAa;CAC5B,CAAC,CAAC;AAEH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/D,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACvC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;QACtC,UAAU,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;QAClC,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;YACvB,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAC7C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;IACtC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;IAC1B,OAAO,CAAC,GAAG,CACT,qCAAqC,IAAI,IAAI,IAAI,cAAc,YAAY,UAAU,iBAAiB,EAAE,CACzG,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;IAC9B,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { createAmpMcpServer } from './create-server.js';
+async function main() {
+    const server = createAmpMcpServer();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+main().catch((err) => {
+    console.error('AMP MCP server failed:', err);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/lib/__tests__/check-permissions.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=check-permissions.test.d.ts.map

package/dist/lib/__tests__/check-permissions.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-permissions.test.d.ts","sourceRoot":"","sources":["../../../src/lib/__tests__/check-permissions.test.ts"],"names":[],"mappings":""}

package/dist/lib/__tests__/check-permissions.test.js

@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest';
+import { checkAgentPermissions, parseAction } from '../check-permissions.js';
+import { validateManifestSyntax } from '../validate-syntax.js';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+const fixture = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '../../../../validator/fixtures/v03-free-valid.json'), 'utf-8'));
+describe('parseAction', () => {
+    it('parses method and path', () => {
+        expect(parseAction('POST /baking/validate-mix')).toEqual({
+            method: 'POST',
+            path: '/baking/validate-mix',
+        });
+    });
+});
+describe('checkAgentPermissions', () => {
+    const manifest = fixture;
+    it('flags undeclared endpoints', () => {
+        const result = checkAgentPermissions('GET /not-in-manifest', manifest);
+        expect(result.verdict).toBe('violation');
+        expect(result.findings.some((f) => f.code === 'endpoint_not_declared')).toBe(true);
+    });
+    it('validates fixture syntax', () => {
+        const syntax = validateManifestSyntax(manifest);
+        expect(syntax.valid).toBe(true);
+        expect(syntax.success_token).toMatch(/^amp-schema-valid:/);
+    });
+});
+//# sourceMappingURL=check-permissions.test.js.map

package/dist/lib/__tests__/check-permissions.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-permissions.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/check-permissions.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,YAAY,CACV,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,oDAAoD,CAAC,EACnG,OAAO,CACR,CACyB,CAAC;AAE7B,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,WAAW,CAAC,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAC;YACvD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,sBAAsB;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,MAAM,QAAQ,GAAG,OAAkC,CAAC;IAEpD,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/check-permissions.d.ts

@@ -0,0 +1,13 @@
+import type { AmpManifest, PermissionCheckResult } from './types.js';
+export declare function parseAction(action: string): {
+    method: string | null;
+    path: string | null;
+};
+export interface CheckPermissionsOptions {
+    /** If true, treat unauthenticated access as a violation when auth is required. */
+    intends_unauthenticated?: boolean;
+    /** If true, agent claims payment/onboarding is already complete. */
+    payment_onboarded?: boolean;
+}
+export declare function checkAgentPermissions(action: string, manifest: AmpManifest, options?: CheckPermissionsOptions): PermissionCheckResult;
+//# sourceMappingURL=check-permissions.d.ts.map

package/dist/lib/check-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-permissions.d.ts","sourceRoot":"","sources":["../../src/lib/check-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAqB,MAAM,YAAY,CAAC;AA8BxF,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAuB1F;AAsDD,MAAM,WAAW,uBAAuB;IACtC,kFAAkF;IAClF,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,WAAW,EACrB,OAAO,GAAE,uBAA4B,GACpC,qBAAqB,CA8GvB"}