@astral-mcp/projection 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Rust
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,61 @@
+# @astral-mcp/projection
+
+Turn any MCP server into a **code-mode** server with **human-approved side
+effects**, built on MCP MRTR (Multi Round-Trip Requests, revision
+2026-07-28) and XState v5.
+
+Projection wraps an existing MCP server and exposes exactly two tools:
+
+- **`execute_machine`** — runs an LLM-authored XState v5 state machine in a
+  QuickJS WebAssembly sandbox. Read-only tool calls execute immediately;
+  any write suspends the machine into a sealed, encrypted blob and asks the
+  human to approve that exact call via MRTR elicitation.
+- **`discover_apis`** — returns generated TypeScript definitions and the
+  authoring contract for the wrapped server's tools.
+
+All suspension state rides the MRTR `requestState` payload, so Projection is
+fully stateless: any server instance can resume any workflow.
+
+## Usage
+
+```ts
+import { createMcpHandler } from '@modelcontextprotocol/server';
+import { wrapMcpServer } from '@astral-mcp/projection';
+
+const facade = await wrapMcpServer(myMcpServer, {
+  blob: { key: myThirtyTwoByteKey }, // shared across instances
+  policy: { query: 'ask' }, // override annotations per tool
+  redact: (tool, args) => ({ ...args, token: '[redacted]' }),
+});
+
+export default createMcpHandler(facade.serverFactory);
+```
+
+`serverFactory` carries the negotiated protocol era into each serving unit:
+modern (2026-07-28) clients get MRTR approval round trips; legacy clients
+still run read-only machines and get a structured error the moment a
+machine needs approval. You can also wrap a connected SDK `Client` to put
+Projection in front of a server you don't own.
+
+## Security model
+
+| Invariant                                               | How it holds                                                                                         |
+| ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
+| The tools bridge is the only way out of the sandbox     | No `fetch`, no filesystem, no host globals; only `xstate` and `@astral-mcp/tools` resolve as imports |
+| No gated call runs without a matching approval          | The approved name and arguments are sealed in the blob and executed from there                       |
+| Clients are untrusted couriers                          | Blobs are AES-256-GCM encrypted under a per-blob HKDF-derived key and authenticated                  |
+| A snapshot cannot resume under different code           | The blob binds a SHA-256 hash of the original `code`                                                 |
+| A wrapped server's annotations are hints, not authority | Unannotated tools default to asking; developer overrides always win                                  |
+| Approval prompts cannot be forged                       | Prompt text comes from the catalog and redacted arguments, rendered inert                            |
+
+## Documentation
+
+- [Server-author integration guide](https://github.com/astralMCP/projection/blob/main/docs/server-authors.md)
+  — policy, blob-key operations, resource caps, lifecycle
+- [Product requirements](https://github.com/astralMCP/projection/blob/main/docs/PRD.md)
+  and [engineering decisions](https://github.com/astralMCP/projection/blob/main/docs/DECISIONS.md)
+- [Repository](https://github.com/astralMCP/projection) — scenario test
+  harness, self-heal benchmark, and an interactive demo TUI live alongside
+  the library
+
+Requires Node ≥ 22. MIT licensed.