@blurt-blockchain/blurt-mcp-server 0.4.0

package/docs/tools.md

@@ -0,0 +1,102 @@
+# Tools & resources
+
+The server exposes **25 read-only tools** (always available) plus **opt-in write tools** (local stdio
+by default; HTTP signing requires an explicit unsafe trusted-deployment override — see
+[write operations](./write-operations.md)).
+
+## Tools
+
+| Tool | Description |
+| --- | --- |
+| `get-account` | Full account info: profile, wallet balances, Blurt Power, delegations, witness votes, rewards. |
+| `get-account-history` | Account operation history, optionally filtered by operation type (vote, transfer, comment, …). |
+| `get-account-posts` | Posts related to an account (blog, feed, posts, comments, replies, payout) via the Nexus L2 API. |
+| `get-post` | A single post, or the full discussion tree (`with_comments=true`). |
+| `get-publications` | Ranked posts (trending, hot, created, promoted, payout, …) via Nexus `getRankedPosts`. |
+| `get-blurt-price` | Current BLURT price in USD and BTC from the public price feed. |
+| `get-chain-status` | Network + market overview: head block, supply, reward fund, participation, price, market cap. |
+| `list-communities` | Directory of Blurt communities (rank / new / subscribers), with search and pagination. |
+| `get-community` | Details of a single community (subscribers, moderators, pending payout, …). |
+| `get-post-votes` | Votes on a post/comment ranked by weight (rshares), for curation analysis. |
+| `get-vote-value` | Estimated value of an account's upvote, in BLURT and USD, at a given weight. |
+| `list-witnesses` | Top witnesses (block producers) ranked by vote weight, with missed blocks and version. |
+| `get-witness` | Single witness details + a health read (vote weight, blocks behind head, enabled). |
+| `get-account-witness-votes` | Which witnesses an account supports (and its proxy, if any). |
+| `get-account-relationships` | Follower/following counts and a sample of each (social graph). |
+| `get-pending-rewards` | Unclaimed author/curation rewards (claimable now), in BLURT and USD. |
+| `get-account-subscriptions` | Communities an account is subscribed to, with its role in each. |
+| `compare-accounts` | Side-by-side metrics for 2–5 accounts (BP, reach, output, earnings) in one call. |
+| `get-referrals` | Accounts a referrer brought to Blurt (beBlurt referral system), with the total count. |
+| `get-account-notifications` | An account's recent notifications (mentions, replies, votes, follows, reblogs) + unread count. |
+| `get-post-reblogs` | The accounts that reblogged a post, and how many (reach signal beyond votes). |
+| `get-delegations` | Outgoing Blurt Power delegations of an account (per delegatee), converted to BLURT. |
+| `lookup-accounts` | Autocomplete Blurt account names by prefix (alphabetical). |
+| `search` | Resolve a free-form query into Blurt resource links (account, history, posts, single post). |
+| `fetch` | Retrieve the raw JSON of a Blurt resource from a `blurt://…` URI or shorthand id. |
+
+`search` and `fetch` follow the connector convention used by ChatGPT-style clients.
+
+Each tool ships with a verbose, LLM-oriented description (visible in the client) explaining when to
+use it, its parameters and its output — for an AI client, the description *is* the interface.
+
+The v1-candidate contract index is generated from source-of-truth registry metadata in
+[`tools.generated.md`](./tools.generated.md). Regenerate it with `npm run docs:tools` and verify it
+with `npm run docs:check`.
+
+## Write tools (opt-in, local stdio by default)
+
+| Tool | Description |
+| --- | --- |
+| `blurt-claim-rewards` | Claim the configured account's pending rewards (`claim_reward_balance`). Supports `dry_run`. |
+| `blurt-upvote` | Upvote a post/comment as the configured account (`vote`), at a given weight. Supports `dry_run`. |
+| `blurt-comment` | Reply to a post/comment as the configured account (`comment`). Stamps `json_metadata.app = blurt-mcp/<version>` and appends a `via Blurt-MCP` footer. Supports `dry_run`. |
+| `blurt-post` | Publish a new top-level post (title, body, tags). Same `blurt-mcp` app stamp + footer as `blurt-comment`. Supports `dry_run`. |
+| `blurt-follow` | Follow or unfollow an account (`custom_json` follow). Supports `dry_run`. |
+| `blurt-mute` | Mute (ignore) or unmute an account (`custom_json` follow/ignore). Supports `dry_run`. |
+| `blurt-subscribe-community` | Subscribe to or leave a community (`custom_json` community). Supports `dry_run`. |
+| `blurt-reblog` | Reblog (re-share) a post to the account's blog (`custom_json` reblog), or undo it. Supports `dry_run`. |
+| `blurt-read-notifications` | Mark the account's notifications as read up to now (`custom_json` notify). Supports `dry_run`. |
+
+All write tools are signed locally with the posting key, **off by default**, and exposed through stdio
+by default. `BLURT_DRY_RUN_DEFAULT=true` can make omitted `dry_run` parameters preview-first without
+blocking explicit execution. HTTP signing is only for explicit unsafe trusted-deployment override mode.
+See [write operations](./write-operations.md).
+
+## Resources
+
+Resource templates resolvable via the `fetch` tool or a resource-aware client:
+
+- `blurt://account/{username}`
+- `blurt://history/{username}?limit=&ops=vote,comment`
+- `blurt://posts/{by}/{tag}?limit=` — `by` ∈ `trending|hot|created|promoted|payout|payout_comments|muted`
+- `blurt://account-posts/{sort}/{account}?limit=` — `sort` ∈ `blog|feed|posts|comments|replies|payout`
+- `blurt://post/{author}/{permlink}?with_comments=true`
+
+## Example prompts
+
+You never tell the AI which tool to use — it picks and chains them. Start simple, then push.
+
+**Market & network**
+- "What is the current BLURT price in USD?"
+- "What is Blurt's market cap and how many BLURT are in circulation?"
+- "Is the Blurt chain healthy right now?"
+
+**Accounts & wallets**
+- "Show me the account `nalexadre` and convert its BLURT balance to USD."
+- "How much Blurt Power does `nalexadre` have?"
+
+**Curation**
+- "How much is a 100% upvote from `nalexadre` worth, in BLURT and USD?"
+- "Who are the top 5 curators on the post `nalexadre/how-ai-can-help-curation-on-blurt-1759501073717`?"
+
+**Communities**
+- "What are the most popular Blurt communities?"
+- "Find a community about photography and show me its details."
+
+**Governance**
+- "List the top 10 Blurt witnesses and flag any that look inactive or behind on version."
+- "Which witnesses does `nalexadre` vote for — and are they all healthy?"
+
+**Multi-step**
+- "Give me a profile of `nalexadre`: bio, the USD value of their vote, and their latest post with its vote count."
+- "Compare `nalexadre`, `megadrive` and `khrom` — stake, reach and earnings — as a table."

package/docs/usage.md

@@ -0,0 +1,157 @@
+# Installation & usage
+
+For connecting a specific client (Claude, ChatGPT, Cursor, …) see the
+[client compatibility matrix](./clients.md). For local signing, see
+[write operations](./write-operations.md).
+
+## Requirements
+
+- Node.js **>= 18** to run the server (uses native `fetch`/`AbortController`).
+- Node.js **>= 20.6** for development and tests (the test runner uses `node --import tsx`).
+- npm
+
+## Installation
+
+For package-based local use, run the official npm package:
+
+```bash
+npx -y -p @blurt-blockchain/blurt-mcp-server blurt-mcp-stdio
+```
+
+For source development:
+
+```bash
+npm install
+```
+
+For copy-paste client configs, see [install snippets](./install-snippets.md).
+
+## Configuration
+
+Copy the example env file and adjust as needed:
+
+```bash
+cp .env.example .env
+```
+
+| Variable | Default | Description |
+| --- | --- | --- |
+| `PORT` | `3000` | HTTP port Express listens on. |
+| `BLURT_RPC_URLS` | a list of public Blurt nodes | Comma-separated Blurt RPC endpoints. **Provide several**: the server scores them continuously (via [`@beblurt/blurt-nodes-checker`](https://gitlab.com/beblurt/blurt-nodes-checker)) and keeps the client on the healthiest ones; offline/stale/forked nodes are dropped. |
+| `BLURT_PRICE_URL` | `https://api.blurt.blog/price_info` | Price feed used by the price/market tools. |
+| `LOG_LEVEL` | `info` | `debug` \| `info` \| `warn` \| `error`. |
+| `NODE_ENV` | `development` | `production` switches logs to JSON output. |
+| `BLURT_CHAIN_ID` | _(mainnet)_ | Optional. Target a **testnet**: set this **and** `BLURT_ADDRESS_PREFIX`. Unset = Blurt main network (dblurt default). |
+| `BLURT_ADDRESS_PREFIX` | _(mainnet `BLT`)_ | Optional. Testnet address prefix; set together with `BLURT_CHAIN_ID`. |
+
+Write-related variables (`BLURT_ACCOUNT`, `BLURT_POSTING_KEY`, `BLURT_WRITE_PROFILE`,
+`BLURT_WRITE_TOOLS_BANNED`, `BLURT_DRY_RUN_DEFAULT`, `BLURT_ENV_FILE`) are documented in
+[write operations](./write-operations.md). The intentionally unsafe HTTP-signing override is also
+documented there because it changes deployment posture and should be reviewed before use.
+
+> The `/mcp` endpoint has **no built-in authentication** and is **read-only** by default — no private
+> keys required for normal HTTP operation. Authentication is planned for a future version.
+
+## Running the HTTP server
+
+Development (hot reload):
+
+```bash
+npm run dev
+```
+
+Production:
+
+```bash
+npm run build
+npm start
+```
+
+The server then listens on `http://localhost:<PORT>/mcp` (HTTP `POST`); `GET` and `DELETE` return
+`405` (stateless mode). It also exposes cheap operational probes outside MCP:
+
+- `GET /healthz` — process liveness;
+- `GET /readyz` — readiness with non-sensitive RPC readiness counters.
+
+> **Deploy behind a reverse proxy** (nginx, Caddy, Traefik, …). Let the proxy terminate TLS and handle
+> rate limiting and `Host`/origin filtering. The public hosted endpoint intentionally remains anonymous
+> and read-only. Do not expose write/signing over HTTP unless you have deliberately enabled the unsafe
+> trusted-deployment override described in [write operations](./write-operations.md#advanced-unsafe-http-signing-for-trusted-deployments).
+> See [SECURITY.md](../SECURITY.md) for the rationale.
+
+### Inspecting
+
+```bash
+npm run inspector
+```
+
+Launches the [MCP Inspector](https://github.com/modelcontextprotocol/inspector) against the built server.
+
+## Connecting an MCP client
+
+The server speaks MCP over **Streamable HTTP** at `POST /mcp` (stateless: no session id). Use the
+hosted instance (`https://mcp.blurt-blockchain.com/mcp`) or your own (`http://localhost:<PORT>/mcp`).
+
+**Apps with native remote-MCP support (Claude, ChatGPT, Grok, Mistral, …):** add a custom/remote
+connector and paste the URL — that's it.
+
+**Desktop apps configured via a JSON file (e.g. Claude Desktop's `claude_desktop_config.json`)** speak
+**stdio**, so bridge to the HTTP server with [`mcp-remote`](https://www.npmjs.com/package/mcp-remote)
+— `npx` fetches it on first run:
+
+```json
+{
+  "mcpServers": {
+    "blurt": {
+      "command": "npx",
+      "args": ["-y", "mcp-remote", "https://mcp.blurt-blockchain.com/mcp"]
+    }
+  }
+}
+```
+
+Swap the URL for `http://localhost:<PORT>/mcp` to point at a server you run yourself.
+
+## Run locally as a stdio server
+
+Prefer a fully local server — no HTTP, no bridge, no hosted dependency? Use the package bin:
+
+```bash
+npx -y -p @blurt-blockchain/blurt-mcp-server blurt-mcp-stdio
+```
+
+Desktop config example:
+
+```json
+{
+  "mcpServers": {
+    "blurt": {
+      "command": "npx",
+      "args": ["-y", "-p", "@blurt-blockchain/blurt-mcp-server", "blurt-mcp-stdio"]
+    }
+  }
+}
+```
+
+When developing from a source checkout instead, build once and point your client at the compiled file:
+
+```bash
+npm install && npm run build
+```
+
+```json
+{
+  "mcpServers": {
+    "blurt": {
+      "command": "node",
+      "args": ["/absolute/path/to/blurt-mcp-server/dist/server-stdio.js"]
+    }
+  }
+}
+```
+
+It registers the same 25 read tools and uses the same RPC node selection as the HTTP server; logs go to
+`stderr` so they never interfere with the protocol on `stdout`. (For development: `npm run dev:stdio`.)
+
+To enable **local signing** (claim rewards, …) on this stdio server, see
+[write operations](./write-operations.md).

package/docs/write-operations.md

@@ -0,0 +1,223 @@
+# Write operations (signing) — opt-in, local by default
+
+Write tools (`blurt-claim-rewards`, `blurt-upvote`, `blurt-comment`, `blurt-post`, `blurt-follow`,
+`blurt-mute`, `blurt-subscribe-community`, `blurt-reblog`, `blurt-read-notifications`) are **off by
+default**. They are registered **only** on the stdio server by default, and **only** when a valid
+**posting** authority is configured. The normal HTTP server refuses to start if a posting key is
+present; an explicitly unsafe HTTP override exists only for trusted operator-controlled deployments
+(see [Advanced: unsafe HTTP signing for trusted deployments](#advanced-unsafe-http-signing-for-trusted-deployments)).
+
+Read [SECURITY.md](../SECURITY.md) for the full threat model and the principles every write tool follows.
+
+## Which key — delegated posting authority (recommended)
+
+`BLURT_ACCOUNT` is the account you act *as*. `BLURT_POSTING_KEY` may be **either**:
+
+1. **A delegated account's posting key (recommended).** Create/own a separate account, grant it
+   **posting authority** over `BLURT_ACCOUNT` (add it to your posting `account_auths` — most wallets
+   call this "posting authority"), and configure the MCP with **that account's** posting key. Your own
+   key is never shared, and you can **revoke** access in one operation (remove the authority) without
+   rotating any key.
+2. **Your account's own posting key.** Simpler, but to revoke it you must change your posting key.
+
+On startup the server validates that the key has posting authority over `BLURT_ACCOUNT` — directly, or
+through a delegated account — and **refuses owner/active keys**. The posting authority cannot move funds.
+
+## Recommended setup — key in a file you control, outside the repo
+
+Put the secret in a file outside the project (e.g. `~/.config/blurt-mcp/secret.env`, `chmod 600`), and
+point the stdio launcher at it with `BLURT_ENV_FILE` — the launcher itself carries **no secret**:
+
+```json
+{
+  "mcpServers": {
+    "blurt": {
+      "command": "node",
+      "args": ["/absolute/path/to/blurt-mcp-server/dist/server-stdio.js"],
+      "env": { "BLURT_ENV_FILE": "/home/you/.config/blurt-mcp/secret.env" }
+    }
+  }
+}
+```
+
+```bash
+# ~/.config/blurt-mcp/secret.env  (chmod 600)
+BLURT_ACCOUNT=youraccount
+BLURT_POSTING_KEY=5J...
+# recommended for new users — claim rewards + upvote only:
+BLURT_WRITE_PROFILE=curator
+# optional — subtract individual tools from the selected profile:
+# BLURT_WRITE_TOOLS_BANNED=upvote
+# optional neutral safety default — omitted dry_run parameters preview first:
+# BLURT_DRY_RUN_DEFAULT=true
+```
+
+The server loads `BLURT_ENV_FILE` (or, if unset, the project's `.env`) regardless of the working
+directory the desktop app launches it from. Variables already set in the launcher's `env` block take
+precedence over the file, so you can also place the values directly in `env` if you prefer.
+
+> Do **not** put the posting key in the project's `.env`: the HTTP server would then refuse to start,
+> and the secret would live inside the working tree. Keep it in a file outside the repo.
+
+## Guarantees
+
+- Only the **posting** key is accepted (active/owner are refused; it cannot move funds). The key is
+  used solely for local signing — never sent to the network, logs, or other dependencies.
+- Write tools are registered **only** on the stdio server by default, gated by the validated key and
+  the `BLURT_WRITE_TOOLS_BANNED` denylist. The HTTP server refuses to start with a key unless the
+  operator explicitly enables the unsafe trusted-deployment override below.
+- Calls are rate-limited (per tool).
+
+Every write tool supports `dry_run: true` to preview **without** broadcasting, and your AI client also
+prompts you to approve each tool call before it runs. Operators who prefer preview-first behavior can
+set `BLURT_DRY_RUN_DEFAULT=true`; omitted `dry_run` parameters then default to preview mode, while an
+explicit `dry_run: false` still executes the operation.
+
+### Neutral infrastructure boundary
+
+The official server intentionally does **not** enforce content, account, tag, community or social-usage
+policy. It validates signing authority, protects unsafe transports by default, lets operators choose
+which write tools are registered, and can default calls to dry-run mode. It does not implement allow/block
+lists for accounts or communities, posting quotas, or moderation policy files; those belong in clients,
+wrappers, gateways, external signers, custom deployments, or forks when an operator needs them. See
+[ADR 0001](./adr/0001-neutral-infrastructure.md).
+
+### Enabling tools with capability profiles
+
+`BLURT_WRITE_PROFILE` is the recommended control for new deployments. It enables a semantic set of
+capabilities, so operators do not need to maintain a long comma-separated list of every tool and do not
+need to edit config just because a future release adds a tool that clearly belongs to the same profile.
+
+If `BLURT_WRITE_PROFILE` is **unset**, the server preserves the historical behavior for backward
+compatibility: all current write tools are enabled, and `BLURT_WRITE_TOOLS_BANNED` subtracts specific
+ones.
+
+Recommended starting point:
+
+```dotenv
+BLURT_WRITE_PROFILE=curator
+```
+
+Profiles:
+
+| Profile | Enables | Intended operator posture |
+| --- | --- | --- |
+| `none` | no write tools | Keep a key configured but temporarily expose no write surface. |
+| `curator` | `claim-rewards`, `upvote` | Safer new-user default: rewards + voting only. |
+| `social` | `curator` plus `follow`, `mute`, `subscribe-community`, `read-notifications`, `reblog` | Social/community actions, but no original text publishing. |
+| `publisher` | all current publishing/social/reward tools | Trusted local assistant that may comment and publish posts. Future high-risk tools should be classified deliberately before joining this profile. |
+| `full` | every write tool in this release | Explicit full-access mode; equivalent to legacy unset-profile behavior for current tools. |
+
+`BLURT_WRITE_TOOLS_BANNED` remains supported as a backward-compatible subtractive control. It always
+removes individual tools from whichever profile is active (or from legacy `full` mode when no profile
+is set). For example, a social operator that wants to allow follows/community/reblogs but not upvotes:
+
+```dotenv
+BLURT_WRITE_PROFILE=social
+BLURT_WRITE_TOOLS_BANNED=upvote
+```
+
+Use the **tool name** column below for denylist entries. Unknown denylist names are ignored so old
+configuration remains forward-compatible across releases; an unknown `BLURT_WRITE_PROFILE` fails
+closed at startup.
+
+| Tool | Tool name | Operation | Rate cap | Profiles |
+| --- | --- | --- | ---: | --- |
+| `blurt-claim-rewards` | `claim-rewards` | `claim_reward_balance` | 6 / hour | `curator`, `social`, `publisher`, `full` |
+| `blurt-upvote` | `upvote` | `vote` | 30 / hour | `curator`, `social`, `publisher`, `full` |
+| `blurt-comment` | `comment` | `comment` (reply) | 10 / hour | `publisher`, `full` |
+| `blurt-post` | `post` | `comment` (top-level) | 10 / hour | `publisher`, `full` |
+| `blurt-follow` | `follow` | `custom_json` follow | 30 / hour | `social`, `publisher`, `full` |
+| `blurt-mute` | `mute` | `custom_json` follow/ignore | 30 / hour | `social`, `publisher`, `full` |
+| `blurt-subscribe-community` | `subscribe-community` | `custom_json` community | 30 / hour | `social`, `publisher`, `full` |
+| `blurt-reblog` | `reblog` | `custom_json` reblog | 30 / hour | `social`, `publisher`, `full` |
+| `blurt-read-notifications` | `read-notifications` | `custom_json` notify | 30 / hour | `social`, `publisher`, `full` |
+
+### Advanced: unsafe HTTP signing for trusted deployments
+
+The default and recommended signing mode is still **local stdio**. However, experienced operators who
+run a private, authenticated, access-controlled deployment may deliberately opt in to exposing the same
+write tools over the HTTP MCP endpoint.
+
+This is intentionally hard to enable. You must configure a valid write context (`BLURT_ACCOUNT` and
+`BLURT_POSTING_KEY`) and set this exact environment variable/value on the HTTP server process:
+
+```dotenv
+BLURT_UNSAFE_ALLOW_HTTP_SIGNING_WITH_POSTING_KEY=I_ACCEPT_FULL_RESPONSIBILITY_FOR_EXPOSING_BLURT_WRITE_TOOLS_OVER_HTTP
+```
+
+Any other value is ignored and the HTTP server still refuses to start with `BLURT_POSTING_KEY` set.
+When the override is active, startup prints a large `UNSAFE HTTP SIGNING ENABLED` warning to `stderr`.
+The override does **not** weaken the other write policies: active/owner keys are still refused, posting
+authority is still validated, `BLURT_WRITE_TOOLS_BANNED` still applies, and rate caps still apply.
+
+Use this only when the HTTP endpoint is protected by your own authentication, TLS, network isolation,
+reverse-proxy controls, monitoring, and operational procedures. Do **not** use it for the public hosted
+endpoint, an anonymous service, or an unauthenticated LAN/WAN deployment. The operator accepts full
+responsibility for every on-chain operation signed by that process. See [SECURITY.md](../SECURITY.md)
+for the full rationale and threat model.
+
+## `blurt-claim-rewards`
+
+Claims the configured account's pending author/curation rewards (`claim_reward_balance`), moving them
+into the account's balance and Blurt Power. Acts only on the configured account; no parameter targets
+another account. Returns the pending amounts and, when executed, the transaction id.
+
+## `blurt-upvote`
+
+Upvotes a post or comment (`vote`) as the configured account.
+
+- Parameters: `author`, `permlink`, `weight` (percent, 1-100, default 100), `dry_run`.
+- Only the configured account votes; on chain, weight 100% = 10000.
+
+## `blurt-comment`
+
+Posts a reply (`comment`) to a post or comment as the configured account.
+
+- Parameters: `parent_author`, `parent_permlink`, `body` (markdown), `dry_run`.
+- A unique permlink is generated automatically. The body gets a `via Blurt-MCP` footer (linking back
+  to this repository) appended after a blank line, and `json_metadata.app` is set to `blurt-mcp/<version>`.
+- Posts are **public and permanent** — use `dry_run: true` first to review the exact final body.
+
+## `blurt-post`
+
+Publishes a **new top-level post** (`comment` with an empty parent) as the configured account.
+
+- Parameters: `title`, `body` (markdown), `tags` (1–8 lowercase tags; the first is the main category),
+  `dry_run`.
+- A unique permlink is generated from the title. Same `via Blurt-MCP` footer and `json_metadata.app =
+  blurt-mcp/<version>` stamping as `blurt-comment`; the tags are stored in `json_metadata.tags`.
+- Posts are **public and permanent** — use `dry_run: true` first to review the exact final post.
+
+## `blurt-follow`
+
+Follows or unfollows another account (`custom_json` id `follow`).
+
+- Parameters: `account`, `action` (`follow` | `unfollow`, default `follow`), `dry_run`.
+
+## `blurt-mute`
+
+Mutes (ignores) or unmutes another account (`custom_json` id `follow`, `what: ['ignore']`), hiding its
+content in compatible frontends.
+
+- Parameters: `account`, `action` (`mute` | `unmute`, default `mute`), `dry_run`.
+
+## `blurt-subscribe-community`
+
+Subscribes the account to a community, or unsubscribes from it (`custom_json` id `community`).
+
+- Parameters: `community` (name/id, e.g. `blurt-192372`), `action` (`subscribe` | `unsubscribe`,
+  default `subscribe`), `dry_run`.
+
+## `blurt-reblog`
+
+Reblogs (re-shares) a post to the account's blog (`custom_json` id `reblog`), or removes a prior reblog.
+
+- Parameters: `author`, `permlink`, `undo` (default `false`), `dry_run`.
+
+## `blurt-read-notifications`
+
+Marks the account's notifications as read up to now (`custom_json` id `notify`, `setLastRead`). Acts
+only on the configured account; no parameter targets another account.
+
+- Parameter: `dry_run`. Pair with `get-account-notifications` to read them first.

package/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "@blurt-blockchain/blurt-mcp-server",
+  "version": "0.4.0",
+  "description": "Model Context Protocol (MCP) server exposing the Blurt blockchain (accounts, history, posts) over Streamable HTTP.",
+  "type": "module",
+  "author": "nalexadre - Blurt blockchain",
+  "license": "GPL-3.0-or-later",
+  "homepage": "https://gitlab.com/blurt-blockchain/blurt-mcp-server",
+  "repository": {
+    "type": "git",
+    "url": "https://gitlab.com/blurt-blockchain/blurt-mcp-server.git"
+  },
+  "bugs": {
+    "url": "https://gitlab.com/blurt-blockchain/blurt-mcp-server/-/issues"
+  },
+  "keywords": [
+    "blurt",
+    "blockchain",
+    "mcp",
+    "model-context-protocol",
+    "dblurt"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "dev": "tsx watch src/server.ts",
+    "start": "node dist/server.js",
+    "start:stdio": "node dist/server-stdio.js",
+    "dev:stdio": "tsx src/server-stdio.ts",
+    "inspector": "npx @modelcontextprotocol/inspector dist/server.js",
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "check:secrets": "node scripts/check-secrets.mjs",
+    "docs:tools": "tsx scripts/generate-tool-docs.ts",
+    "docs:check": "npm run docs:tools && git diff --exit-code docs/tools.generated.md",
+    "test": "node --import tsx --test test/uri.test.ts test/search.test.ts test/contract.test.ts test/resilience.test.ts test/write.test.ts test/ops.test.ts test/package.test.ts test/stdio.test.ts test/network.test.ts",
+    "test:live": "node --import tsx --test test/live.test.ts",
+    "test:http": "node --import tsx --test test/http.test.ts",
+    "smoke:http": "node scripts/smoke-http.mjs",
+    "test:all": "node --import tsx --test test/*.test.ts",
+    "release": "commit-and-tag-version",
+    "release:minor": "commit-and-tag-version --release-as minor",
+    "release:major": "commit-and-tag-version --release-as major",
+    "release:dry": "commit-and-tag-version --dry-run",
+    "pack:check": "npm run build && npm pack --dry-run",
+    "smoke:package": "node scripts/smoke-package.mjs"
+  },
+  "dependencies": {
+    "@beblurt/blurt-nodes-checker": "^2.2.0",
+    "@beblurt/dblurt": "^0.15.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "dotenv": "^17.4.2",
+    "express": "^5.2.1",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.6",
+    "@types/node": "^26.0.1",
+    "commit-and-tag-version": "^12.7.3",
+    "tsx": "^4.22.4",
+    "typescript": "^5.9.3"
+  },
+  "main": "dist/server.js",
+  "bin": {
+    "blurt-mcp-server": "dist/server.js",
+    "blurt-mcp-stdio": "dist/server-stdio.js"
+  },
+  "files": [
+    "dist/",
+    "docs/",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "SECURITY.md"
+  ]
+}