@atbas/m-mcp 0.1.0

package/knowledge/templates/python/checkout-redirect.tmpl

@@ -0,0 +1,148 @@
+"""JazzCash — {{FLOW_TITLE}}
+
+Generated by the JazzCash MCP server from {{FLOW_ID}} ({{CORPUS_VERSION}} guides).
+Sources: {{DOC_SOURCES}}
+
+Builds a signed, auto-submitting form that redirects the customer to the
+JazzCash hosted payment page.
+
+SAFETY NOTES
+  - Sandbox and production use the SAME URL. The environment is decided by the
+    credentials alone.
+  - The Integrity Salt is the HMAC key and must never reach the browser. This
+    module runs server-side and emits only the finished hash.
+  - pp_ReturnURL must be byte-identical to the URL registered in the portal.
+
+Requires Python 3.9 or later (zoneinfo).
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import html
+import os
+import secrets
+import string
+from datetime import datetime, timedelta
+from decimal import Decimal, ROUND_DOWN
+from typing import Any, Mapping
+from zoneinfo import ZoneInfo
+
+JAZZCASH_POST_URL = '{{ENDPOINT}}'
+PAKISTAN = ZoneInfo('Asia/Karachi')
+
+# pp_TxnRefNo is annotated [20AN] in the guides: at most 20 letters and digits.
+MAX_REFERENCE_LENGTH = 20
+REFERENCE_ALPHABET = string.ascii_letters + string.digits
+
+
+def txn_date_time(moment: datetime | None = None) -> str:
+    return (moment or datetime.now(PAKISTAN)).astimezone(PAKISTAN).strftime('%Y%m%d%H%M%S')
+
+
+def generate_reference(prefix: str, moment: datetime | None = None) -> str:
+    """Reference that stays unique inside a single millisecond.
+
+    The clock alone is not enough: two orders placed in the same millisecond
+    produce the same reference, and the gateway rejects the second as a
+    duplicate. The random suffix fills whatever the prefix and the timestamp
+    leave of the 20-character budget, drawn from `secrets`, not `random`.
+    """
+    stamp = txn_date_time(moment)
+    room = MAX_REFERENCE_LENGTH - len(prefix) - len(stamp)
+
+    if room < 1:
+        raise ValueError(
+            f'Reference prefix {prefix!r} leaves no room inside the {MAX_REFERENCE_LENGTH}-character limit.'
+        )
+
+    suffix = ''.join(secrets.choice(REFERENCE_ALPHABET) for _ in range(room))
+
+    return f'{prefix}{stamp}{suffix}'
+
+
+def to_minor_units(major_amount: str) -> str:
+    """Convert rupees to minor units. Decimal, never float."""
+    value = Decimal(str(major_amount))
+    if value <= 0:
+        raise ValueError('Amount must be greater than zero.')
+    if value != value.quantize(Decimal('0.01'), rounding=ROUND_DOWN):
+        raise ValueError('Amount must have at most two decimal places.')
+    return str(int(value * 100))
+
+
+def secure_hash(parameters: Mapping[str, Any], integrity_salt: str) -> str:
+    values = [
+        str(parameters[name])
+        for name in sorted(parameters)
+        if name != 'pp_SecureHash' and parameters[name] is not None and str(parameters[name]) != ''
+    ]
+
+    message = integrity_salt if not values else integrity_salt + '&' + '&'.join(values)
+
+    return hmac.new(integrity_salt.encode('utf-8'), message.encode('utf-8'), hashlib.sha256).hexdigest()
+
+
+def build_checkout_parameters(amount_major: str, bill_reference: str, description: str) -> dict[str, str]:
+    """Build the signed parameter set for one order."""
+    merchant_id = os.environ.get('JAZZCASH_MERCHANT_ID', '')
+    password = os.environ.get('JAZZCASH_PASSWORD', '')
+    integrity_salt = os.environ.get('JAZZCASH_INTEGRITY_SALT', '')
+    return_url = os.environ.get('JAZZCASH_RETURN_URL', '')
+
+    if not merchant_id or not password or not integrity_salt or not return_url:
+        raise RuntimeError('JazzCash credentials are not configured.')
+
+    now = datetime.now(PAKISTAN)
+
+    parameters: dict[str, str] = {
+{{PARAMS}}
+    }
+    parameters['pp_MerchantID'] = merchant_id
+    parameters['pp_Password'] = password
+    parameters['pp_ReturnURL'] = return_url
+    # Unique per transaction. Replace TRN with your own three-letter merchant
+    # prefix, as the guides recommend.
+    parameters['pp_TxnRefNo'] = generate_reference('TRN', now)
+    parameters['pp_Amount'] = to_minor_units(amount_major)
+    parameters['pp_BillReference'] = bill_reference
+    parameters['pp_Description'] = description
+    parameters['pp_TxnDateTime'] = txn_date_time(now)
+    parameters['pp_TxnExpiryDateTime'] = txn_date_time(now + timedelta(days=1))
+
+    parameters['pp_SecureHash'] = secure_hash(parameters, integrity_salt)
+
+    return parameters
+
+
+def render_checkout_form(parameters: Mapping[str, str]) -> str:
+    """Render an auto-submitting HTML form. Every value is HTML-escaped."""
+    inputs = '\n'.join(
+        f'    <input type="hidden" name="{html.escape(name, quote=True)}" '
+        f'value="{html.escape(str(value), quote=True)}">'
+        for name, value in parameters.items()
+    )
+
+    return (
+        '<!DOCTYPE html>\n'
+        '<html lang="en">\n'
+        '<head><meta charset="UTF-8"><title>Redirecting to JazzCash…</title></head>\n'
+        '<body>\n'
+        '  <p>Redirecting you to the JazzCash secure payment page…</p>\n'
+        f'  <form id="jazzcash" method="post" action="{html.escape(JAZZCASH_POST_URL, quote=True)}">\n'
+        f'{inputs}\n'
+        '    <noscript><button type="submit">Continue</button></noscript>\n'
+        '  </form>\n'
+        "  <script>document.getElementById('jazzcash').submit();</script>\n"
+        '</body>\n'
+        '</html>'
+    )
+
+
+# Example wiring with Flask:
+#
+#   @app.post('/checkout')
+#   def checkout():
+#       parameters = build_checkout_parameters('1.00', 'billref001', 'Order 1024')
+#       return render_checkout_form(parameters)

package/knowledge/templates/python/ipn-handler.tmpl

@@ -0,0 +1,110 @@
+"""JazzCash IPN (Instant Payment Notification) listener — {{FRAMEWORK}}
+
+Generated by the JazzCash MCP server ({{CORPUS_VERSION}} guides).
+Sources: {{DOC_SOURCES}}
+
+Register this URL under Integration > Credentials in the merchant portal.
+
+CONTRACT
+  - Respond within 60 seconds. JazzCash retries twice on failure or timeout.
+  - Therefore this handler MUST be idempotent: the same notification can
+    legitimately arrive three times.
+  - This URL is public. Anyone can post to it. VERIFY THE HASH FIRST.
+  - In an inbound IPN the payment outcome is in pp_ResponseCode: 121 succeeded,
+    199/999 failed. (In a Status Inquiry response it is pp_PaymentResponseCode.)
+
+Requires `flask`.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import logging
+import os
+from typing import Any, Mapping
+
+from flask import Flask, jsonify, request
+
+app = Flask(__name__)
+logger = logging.getLogger(__name__)
+
+INTEGRITY_SALT = os.environ.get('JAZZCASH_INTEGRITY_SALT', '')
+if not INTEGRITY_SALT:
+    raise RuntimeError('JAZZCASH_INTEGRITY_SALT is not configured.')
+
+
+def secure_hash(parameters: Mapping[str, Any], integrity_salt: str) -> str:
+    values = [
+        str(parameters[name])
+        for name in sorted(parameters)
+        if name not in ('pp_SecureHash', 'SecureHash')
+        # The gateway sends JSON null in IPN payloads even though merchants are
+        # told never to send null. Treat None as empty when hashing.
+        and parameters[name] is not None
+        and str(parameters[name]) != ''
+    ]
+
+    message = integrity_salt if not values else integrity_salt + '&' + '&'.join(values)
+
+    return hmac.new(integrity_salt.encode('utf-8'), message.encode('utf-8'), hashlib.sha256).hexdigest()
+
+
+def acknowledgement(message: str) -> dict[str, str]:
+    body = {'pp_ResponseCode': '000', 'pp_ResponseMessage': message}
+    body['pp_SecureHash'] = secure_hash(body, INTEGRITY_SALT)
+    return body
+
+
+@app.post('{{IPN_PATH}}')
+def jazzcash_ipn():  # type: ignore[no-untyped-def]
+    notification = request.get_json(silent=True)
+
+    if not isinstance(notification, dict):
+        return jsonify({'pp_ResponseCode': '400', 'pp_ResponseMessage': 'Malformed body'}), 400
+
+    # 1. Verify the hash BEFORE anything else.
+    supplied = str(notification.get('pp_SecureHash', ''))
+    recomputed = secure_hash(notification, INTEGRITY_SALT)
+
+    if not supplied or not hmac.compare_digest(recomputed.lower(), supplied.strip().lower()):
+        logger.error('JazzCash IPN rejected: secure hash did not verify.')
+        return jsonify({'pp_ResponseCode': '400', 'pp_ResponseMessage': 'Invalid secure hash'}), 400
+
+    txn_ref_no = str(notification.get('pp_TxnRefNo', ''))
+    response_code = str(notification.get('pp_ResponseCode', ''))
+
+    # 2. Look up the order. Replace with your own persistence layer.
+    # order = find_order_by_reference(txn_ref_no)
+    # if order is None:
+    #     return jsonify(acknowledgement('IPN received successfully'))
+
+    # 3. Idempotency: a retry must not fulfil the order twice.
+    # if order.is_paid:
+    #     return jsonify(acknowledgement('IPN received successfully'))
+
+    # 4. Confirm the amount matches what you recorded, so a replayed or altered
+    #    notification cannot mark a large order paid from a small transaction.
+    # if str(order.amount_minor_units) != str(notification.get('pp_Amount', '')):
+    #     logger.error('JazzCash IPN amount mismatch for %s', txn_ref_no)
+    #     return jsonify(acknowledgement('IPN received successfully'))
+
+    # 5. Interpret the outcome.
+    if response_code == '121':
+        # Paid. Mark the order paid, then do slow work asynchronously.
+        # mark_order_paid(txn_ref_no, notification)
+        pass
+    elif response_code in ('199', '999'):
+        # Failed. Do not release goods.
+        # mark_order_failed(txn_ref_no, notification)
+        pass
+    else:
+        # Undocumented code: unresolved, NOT failed. Reconcile with Status Inquiry.
+        logger.error('JazzCash IPN carried undocumented code %s for %s', response_code, txn_ref_no)
+
+    # 6. Acknowledge well inside the 60-second window.
+    return jsonify(acknowledgement('IPN received successfully'))
+
+
+if __name__ == '__main__':
+    app.run(port=int(os.environ.get('PORT', '3000')))

package/knowledge/templates/python/rest-client.tmpl

@@ -0,0 +1,179 @@
+"""JazzCash — {{FLOW_TITLE}}
+
+Generated by the JazzCash MCP server from {{FLOW_ID}} ({{CORPUS_VERSION}} guides).
+Sources: {{DOC_SOURCES}}
+
+SAFETY NOTES
+  - Sandbox and production use the SAME URL ({{ENDPOINT}}). The environment is
+    decided entirely by the credentials. Confirm which are loaded before running.
+  - Moves money: {{MOVES_MONEY}}.
+
+Requires Python 3.9 or later (zoneinfo) and `requests`.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import os
+import secrets
+import string
+from datetime import datetime, timedelta
+from decimal import Decimal, ROUND_DOWN
+from typing import Any, Mapping
+from zoneinfo import ZoneInfo
+
+import requests
+
+JAZZCASH_ENDPOINT = '{{ENDPOINT}}'
+TIMEOUT_SECONDS = 30
+PAKISTAN = ZoneInfo('Asia/Karachi')
+
+# pp_TxnRefNo and pp_RequestID are annotated [20AN] in the guides: at most 20
+# letters and digits.
+MAX_REFERENCE_LENGTH = 20
+REFERENCE_ALPHABET = string.ascii_letters + string.digits
+
+
+def txn_date_time(moment: datetime | None = None) -> str:
+    """Format an instant as YYYYMMDDHHMMSS in Pakistan Standard Time.
+
+    An explicit time zone is used so the stamp is correct regardless of the host
+    clock: a server in UTC and one in New York must produce the same value.
+    """
+    return (moment or datetime.now(PAKISTAN)).astimezone(PAKISTAN).strftime('%Y%m%d%H%M%S')
+
+
+def txn_expiry_date_time(moment: datetime | None = None) -> str:
+    """Expiry stamp, one day after the transaction, as the guides require."""
+    return txn_date_time((moment or datetime.now(PAKISTAN)) + timedelta(days=1))
+
+
+def to_minor_units(major_amount: str) -> str:
+    """Convert rupees to the minor units the gateway expects.
+
+    Decimal, never float: binary floating point cannot represent money exactly.
+    """
+    value = Decimal(str(major_amount))
+    if value <= 0:
+        raise ValueError('Amount must be greater than zero.')
+    if value != value.quantize(Decimal('0.01'), rounding=ROUND_DOWN):
+        raise ValueError('Amount must have at most two decimal places.')
+    return str(int(value * 100))
+
+
+def generate_reference(prefix: str = 'T', moment: datetime | None = None) -> str:
+    """Reference that stays unique inside a single millisecond.
+
+    The clock alone is not enough: two orders placed in the same millisecond
+    produce the same reference, and the gateway rejects the second as a
+    duplicate. The random suffix fills whatever the prefix and the timestamp
+    leave of the 20-character budget, drawn from `secrets`, not `random`.
+    """
+    stamp = txn_date_time(moment)
+    room = MAX_REFERENCE_LENGTH - len(prefix) - len(stamp)
+
+    if room < 1:
+        raise ValueError(
+            f'Reference prefix {prefix!r} leaves no room inside the {MAX_REFERENCE_LENGTH}-character limit.'
+        )
+
+    suffix = ''.join(secrets.choice(REFERENCE_ALPHABET) for _ in range(room))
+
+    return f'{prefix}{stamp}{suffix}'
+
+
+def secure_hash(parameters: Mapping[str, Any], integrity_salt: str) -> str:
+    """Build pp_SecureHash.
+
+    Sort by parameter NAME ascending, join the non-empty VALUES with '&',
+    prepend the Integrity Salt, then HMAC-SHA256 with the salt as the key.
+    """
+    values = [
+        str(parameters[name])
+        for name in sorted(parameters)
+        if name not in ('pp_SecureHash', 'SecureHash')
+        and parameters[name] is not None
+        and str(parameters[name]) != ''
+    ]
+
+    message = integrity_salt if not values else integrity_salt + '&' + '&'.join(values)
+
+    return hmac.new(integrity_salt.encode('utf-8'), message.encode('utf-8'), hashlib.sha256).hexdigest()
+
+
+def hash_matches(left: str, right: str) -> bool:
+    """Constant-time, case-insensitive comparison.
+
+    JazzCash returns uppercase hex; hexdigest() produces lowercase. Same digest.
+    """
+    return hmac.compare_digest(str(left).strip().lower(), str(right).strip().lower())
+
+
+def _credentials() -> tuple[str, str, str]:
+    merchant_id = os.environ.get('JAZZCASH_MERCHANT_ID', '')
+    password = os.environ.get('JAZZCASH_PASSWORD', '')
+    integrity_salt = os.environ.get('JAZZCASH_INTEGRITY_SALT', '')
+
+    if not merchant_id or not password or not integrity_salt:
+        raise RuntimeError('JazzCash credentials are not configured.')
+
+    return merchant_id, password, integrity_salt
+
+
+def run(**overrides: str) -> dict[str, Any]:
+    """Execute {{FLOW_ID}}.
+
+    Every value marked TODO must be supplied by your application, either by
+    editing the literal below or by passing it as a keyword argument. pp_Amount
+    is in MINOR units: pass `to_minor_units('100.00')` rather than a rupee
+    float, so the conversion is exact.
+    """
+    merchant_id, password, integrity_salt = _credentials()
+
+    parameters: dict[str, Any] = {
+{{PARAMS}}
+    }
+    parameters.update(overrides)
+    parameters['pp_MerchantID'] = merchant_id
+    parameters['pp_Password'] = password
+{{RUNTIME_OVERRIDES}}
+
+    # Hash LAST, from exactly the mapping about to be transmitted.
+    parameters['pp_SecureHash'] = secure_hash(parameters, integrity_salt)
+
+    # Never log `parameters`: it carries the password.
+    response = requests.post(
+        JAZZCASH_ENDPOINT,
+        json=parameters,
+        headers={'Content-Type': 'application/json', 'Accept': 'application/json'},
+        timeout=TIMEOUT_SECONDS,
+    )
+
+    try:
+        result: dict[str, Any] = response.json()
+    except ValueError as error:
+        raise RuntimeError(f'JazzCash returned a non-JSON body with HTTP {response.status_code}.') from error
+
+    if result.get('{{SUCCESS_FIELD}}') == '{{SUCCESS_VALUE}}':
+{{SETTLEMENT_CHECK}}        # For Status Inquiry this only means the enquiry worked. Read
+        # pp_PaymentResponseCode for the payment outcome: 121 means completed.
+{{SUCCESS_REPORT}}
+    else:
+        # An unrecognised code is UNRESOLVED, not failed. Resolve it with the
+        # Status Inquiry API before refunding or re-charging.
+        print('JazzCash call unresolved. Code:', result.get('{{SUCCESS_FIELD}}'))
+
+    response_hash = result.get('{{RESPONSE_HASH_FIELD}}')
+    if isinstance(response_hash, str) and response_hash:
+        if not hash_matches(secure_hash(result, integrity_salt), response_hash):
+            # JazzCash does not document which response fields feed this hash, so
+            # a mismatch means UNVERIFIED, not proven tampering. Reconcile through
+            # Status Inquiry rather than rejecting the payment.
+            print('JazzCash response hash could not be verified for', result.get('pp_TxnRefNo'))
+
+    return result
+
+
+if __name__ == '__main__':
+    run()

package/knowledge/templates/python/wallet-linking.tmpl

@@ -0,0 +1,133 @@
+"""JazzCash — MWallet linking form
+
+Generated by the JazzCash MCP server from {{FLOW_ID}} ({{CORPUS_VERSION}} guides).
+Sources: {{DOC_SOURCES}}
+
+  - Sandbox and production use the SAME URL. The environment is decided by the
+    credentials alone: going live is a credential swap, not a URL change.
+
+TWO CORRECTIONS TO THE OFFICIAL SAMPLE, both deliberate:
+
+  1. The sample in the guide computes the hash in browser JavaScript with the
+     Integrity Salt embedded in the page. The salt is the HMAC key: publishing it
+     lets anyone forge a valid pp_SecureHash for your merchant account. This
+     module runs server-side and emits only the finished hash.
+
+  2. The sample posts to https://pgw.jazzcash.com.pk/..., contradicting the
+     endpoint table and screenshot in the same document. This module uses the
+     endpoint from the table: {{ENDPOINT}}
+
+Requires Python 3.9 or later (zoneinfo).
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import html
+import os
+import re
+import secrets
+import string
+from datetime import datetime
+from typing import Any, Mapping
+from zoneinfo import ZoneInfo
+
+JAZZCASH_LINKING_URL = '{{ENDPOINT}}'
+PAKISTAN = ZoneInfo('Asia/Karachi')
+MSISDN_PATTERN = re.compile(r'^03\d{9}$')
+
+# pp_RequestID is annotated [20AN] in the guides: at most 20 letters and digits.
+MAX_REFERENCE_LENGTH = 20
+REFERENCE_ALPHABET = string.ascii_letters + string.digits
+
+
+def generate_reference(prefix: str, moment: datetime | None = None) -> str:
+    """Reference that stays unique inside a single millisecond.
+
+    The clock alone is not enough: two linking attempts started in the same
+    millisecond produce the same pp_RequestID, and the gateway rejects the
+    second as a duplicate. Drawn from `secrets`, not `random`.
+    """
+    stamp = (moment or datetime.now(PAKISTAN)).astimezone(PAKISTAN).strftime('%Y%m%d%H%M%S')
+    room = MAX_REFERENCE_LENGTH - len(prefix) - len(stamp)
+
+    if room < 1:
+        raise ValueError(
+            f'Reference prefix {prefix!r} leaves no room inside the {MAX_REFERENCE_LENGTH}-character limit.'
+        )
+
+    suffix = ''.join(secrets.choice(REFERENCE_ALPHABET) for _ in range(room))
+
+    return f'{prefix}{stamp}{suffix}'
+
+
+def secure_hash(parameters: Mapping[str, Any], integrity_salt: str) -> str:
+    values = [
+        str(parameters[name])
+        for name in sorted(parameters)
+        if name != 'pp_SecureHash' and parameters[name] is not None and str(parameters[name]) != ''
+    ]
+
+    message = integrity_salt if not values else integrity_salt + '&' + '&'.join(values)
+
+    return hmac.new(integrity_salt.encode('utf-8'), message.encode('utf-8'), hashlib.sha256).hexdigest()
+
+
+def build_linking_parameters(msisdn: str) -> dict[str, str]:
+    """Build the signed linking parameters for one customer wallet number."""
+    if not MSISDN_PATTERN.match(str(msisdn)):
+        raise ValueError('A Pakistani mobile wallet number in the form 03XXXXXXXXX is required.')
+
+    merchant_id = os.environ.get('JAZZCASH_MERCHANT_ID', '')
+    password = os.environ.get('JAZZCASH_PASSWORD', '')
+    integrity_salt = os.environ.get('JAZZCASH_INTEGRITY_SALT', '')
+    return_url = os.environ.get('JAZZCASH_RETURN_URL', '')
+
+    if not merchant_id or not password or not integrity_salt or not return_url:
+        raise RuntimeError('JazzCash credentials are not configured.')
+
+    now = datetime.now(PAKISTAN)
+
+    parameters: dict[str, str] = {
+{{PARAMS}}
+    }
+    parameters['pp_MerchantID'] = merchant_id
+    parameters['pp_Password'] = password
+    parameters['pp_MSISDN'] = str(msisdn)
+    # Must be unique for every linking attempt.
+    parameters['pp_RequestID'] = generate_reference('R', now)
+    parameters['pp_ReturnURL'] = return_url
+
+    parameters['pp_SecureHash'] = secure_hash(parameters, integrity_salt)
+
+    return parameters
+
+
+def render_linking_form(parameters: Mapping[str, str]) -> str:
+    """Render an auto-submitting linking form. Every value is HTML-escaped."""
+    inputs = '\n'.join(
+        f'    <input type="hidden" name="{html.escape(name, quote=True)}" '
+        f'value="{html.escape(str(value), quote=True)}">'
+        for name, value in parameters.items()
+    )
+
+    return (
+        '<!DOCTYPE html>\n'
+        '<html lang="en">\n'
+        '<head><meta charset="UTF-8"><title>Link your JazzCash wallet</title></head>\n'
+        '<body>\n'
+        '  <p>You will be asked for your MPIN on the JazzCash page.</p>\n'
+        f'  <form id="link-wallet" method="post" action="{html.escape(JAZZCASH_LINKING_URL, quote=True)}">\n'
+        f'{inputs}\n'
+        '    <noscript><button type="submit">Continue</button></noscript>\n'
+        '  </form>\n'
+        "  <script>document.getElementById('link-wallet').submit();</script>\n"
+        '</body>\n'
+        '</html>'
+    )
+
+
+# On return, JazzCash posts a payment token to your Return URL. Store it against
+# the customer and charge it later with the token payment API. Call the Token
+# Inquiry API before charging: the customer may have unlinked their wallet.

package/package.json

@@ -0,0 +1,84 @@
+{
+  "name": "@atbas/m-mcp",
+  "version": "0.1.0",
+  "packageManager": "npm@12.0.2",
+  "license": "MIT",
+  "description": "MCP server that performs JazzCash payment-gateway integrations inside a merchant's own AI tooling.",
+  "author": "Eren Atbas <eren.atbas@gmail.com>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/eatbas/m-mcp.git"
+  },
+  "homepage": "https://m-mcp.atbas.xyz/",
+  "bugs": {
+    "url": "https://github.com/eatbas/m-mcp/issues"
+  },
+  "keywords": [
+    "jazzcash",
+    "mcp",
+    "model-context-protocol",
+    "payments",
+    "pakistan",
+    "payment-gateway",
+    "woocommerce",
+    "integration"
+  ],
+  "type": "module",
+  "engines": {
+    "node": ">=24.18.0"
+  },
+  "bin": {
+    "m-mcp": "dist/index.js"
+  },
+  "main": "dist/index.js",
+  "files": [
+    "dist",
+    "knowledge",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "npm run clean && tsc -p tsconfig.build.json",
+    "clean": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
+    "prepublishOnly": "npm run release:check",
+    "pack:check": "npm run build && npm pack --dry-run",
+    "release:check": "npm run scan:credentials && node scripts/require-php.mjs && node scripts/require-python.mjs && npm run typecheck && npm run lint && npm run format:check && npm run test:coverage && npm run pack:check",
+    "deploy": "npm run build && node dist/install/cli.js",
+    "deploy:list": "npm run build && node dist/install/cli.js --list",
+    "dev": "tsx src/index.ts",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:fast": "vitest run tests/domain tests/validation tests/catalogue tests/config tests/telemetry",
+    "test:changed": "vitest related --run",
+    "test:coverage": "vitest run --coverage",
+    "extract-pdf-text": "node scripts/extract-pdf-text.mjs",
+    "scan:credentials": "node scripts/scan-credentials.mjs"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^24.13.3",
+    "@vitest/coverage-v8": "^4.1.10",
+    "eslint": "^10.8.0",
+    "eslint-config-prettier": "^10.0.1",
+    "globals": "^17.8.0",
+    "prettier": "^3.4.2",
+    "tsx": "^4.19.2",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.23.0",
+    "vitest": "^4.1.10"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "allowScripts": {
+    "esbuild@0.28.2": true,
+    "fsevents": false
+  }
+}