@certscore/mcp 0.2.0 → 0.2.2

package/LICENSE

@@ -1,4 +1,4 @@
-Proprietary. All rights reserved.
+UNLICENSED
 
 Copyright (c) ErgoVeritas, LLC.
 

package/README.md

@@ -2,9 +2,7 @@
 
 CertScore MCP exposes a focused Model Context Protocol server for CertScore Pulse workflows.
 
-Status: public developer preview. The server is distributed for external MCP clients through npm and Homebrew. Local WC01 development uses `pnpm mcp:certscore`.
-
-<!-- mcp-name: ai.certscore/mcp -->
+Status: public developer preview. The server is distributed for external macOS MCP clients through Homebrew. Local WC01 development uses `pnpm mcp:certscore`.
 
 Public docs:
 
@@ -27,34 +25,10 @@ Public docs:
 - `get_latest_domain_scan` - Retrieve the latest eligible API v2 public-safe scan for a domain.
 - `get_latest_domain_pre_consent_cookies_trackers` - Retrieve the public-safe Cookies & Trackers (Pre-consent) table from the latest eligible scan for a domain.
 
-The initial MCP surface intentionally does not include account scan browsing or scan comparison tools.
+The initial MCP surface intentionally does not include account scan browsing, scan comparison tools, or the removed `create_scan` compatibility alias.
 
 ## Configuration
 
-Recommended MCP client config:
-
-```json
-{
-  "mcpServers": {
-    "certscore": {
-      "command": "npx",
-      "args": ["-y", "@certscore/mcp"],
-      "env": {
-        "CERTSCORE_API_KEY": "YOUR_TOKEN",
-        "CERTSCORE_BASE_URL": "https://certscore.ai"
-      }
-    }
-  }
-}
-```
-
-Install globally with npm if your MCP client requires a persistent command:
-
-```bash
-npm install -g @certscore/mcp
-certscore-mcp --version
-```
-
 Install with Homebrew on macOS:
 
 ```bash
@@ -110,7 +84,7 @@ CERTSCORE_REQUEST_TIMEOUT_MS=300000
 
 ## API Key Access
 
-MCP clients usually need `scan:read`, `scan:create`, and `mcp` scopes. Sign in to CertScore, verify your email, then request a self-serve `cs_mcp_` key from `POST /api/v2/keys/request`. Self-serve keys include scan creation within the published rate limits. Email `support@certscore.ai` for higher limits or custom access.
+MCP clients usually need `scan:read`, `scan:create`, and `mcp` scopes. Request developer-preview access by emailing `support@certscore.ai` with your organization, MCP client, expected workflow, expected request volume, contact email, and requested scopes.
 
 ## Verify Install
 
@@ -146,8 +120,7 @@ Cursor config:
 {
   "mcpServers": {
     "certscore": {
-      "command": "npx",
-      "args": ["-y", "@certscore/mcp"],
+      "command": "certscore-mcp",
       "env": {
         "CERTSCORE_API_KEY": "YOUR_TOKEN",
         "CERTSCORE_BASE_URL": "https://certscore.ai"
@@ -163,8 +136,7 @@ Windsurf or generic stdio MCP client config:
 {
   "mcpServers": {
     "certscore": {
-      "command": "npx",
-      "args": ["-y", "@certscore/mcp"],
+      "command": "certscore-mcp",
       "env": {
         "CERTSCORE_API_KEY": "YOUR_TOKEN",
         "CERTSCORE_BASE_URL": "https://certscore.ai"
@@ -251,7 +223,7 @@ This verifies the Homebrew-installed `certscore-mcp` command against live `https
 
 - Command not found: run the Homebrew install again and confirm Homebrew's bin directory is on `PATH`.
 - Missing API key: set `CERTSCORE_API_KEY` in the MCP client environment and rerun `certscore-mcp doctor`.
-- Bad token: rotate the key or request a fresh scoped API/MCP key.
+- Bad token: rotate the key or request a scoped API/MCP key from `support@certscore.ai`.
 - API unreachable: check `CERTSCORE_BASE_URL` and verify `https://certscore.ai/api/v2/health`.
 - Homebrew tap stale: run `brew update` and reinstall `certscore-mcp`.
 - Old cached release: run `brew reinstall --cask certscore-mcp` after updating the tap.

package/dist/certscore-mcp.mjs

@@ -17846,7 +17846,7 @@ var pulseErrorSchema = external_exports.object({
 var apiV2Disclaimer = "CertScore outputs are automated public-web observations for review. They are not legal advice, certification, or a compliance determination.";
 var apiV2ScanStatusSchema = external_exports.enum(["queued", "running", "finalizing", "completed", "completed_limited", "failed", "expired", "rate_limited"]);
 var apiV2ScanFreshnessSchema = external_exports.enum(["latest", "refresh"]);
-var apiV2ScanFromSchema = external_exports.enum(["eu_ie"]);
+var apiV2ScanFromSchema = external_exports.enum(["eu_ie", "eu_de", "california"]);
 var apiV2FindingCriticalitySchema = external_exports.enum(["critical", "high", "medium", "low", "info", "unknown"]);
 var apiV2FindingConfidenceSchema = external_exports.enum(["strong", "good", "moderate", "weak", "unknown"]);
 var apiV2EvidenceBasisSchema = external_exports.enum(["runtime_observation", "policy_surface_detection", "accessibility_check", "public_report_projection"]);
@@ -17982,8 +17982,6 @@ var apiV2PreConsentCookiesTrackersRowSchema = external_exports.object({
   name: external_exports.string(),
   vendor: external_exports.string().nullable().optional(),
   host: external_exports.string().nullable().optional(),
-  domains: external_exports.array(external_exports.string()).optional(),
-  cookieNames: external_exports.array(external_exports.string()).optional(),
   registrableDomain: external_exports.string().nullable().optional(),
   category: external_exports.string().nullable().optional(),
   purpose: external_exports.string().nullable().optional(),
@@ -17994,12 +17992,6 @@ var apiV2PreConsentCookiesTrackersRowSchema = external_exports.object({
   phase: apiV2PreConsentInventoryPhaseSchema,
   observedBeforeConsent: external_exports.boolean(),
   evidenceBasis: external_exports.literal("public_report_projection"),
-  attributionEvidence: external_exports.object({
-    signatureId: external_exports.string(),
-    matchedOn: external_exports.enum(["cookie_name", "domain", "request_pattern", "id_sync"]),
-    matchedValue: external_exports.string()
-  }).strict().nullable().optional(),
-  syncedIdentifiers: external_exports.array(external_exports.string()).optional(),
   firstObservedAtMs: external_exports.number().int().min(0).nullable().optional(),
   pageUrlHost: external_exports.string().nullable().optional()
 }).strict();
@@ -18025,7 +18017,7 @@ var mcpPulseDetailSchema = external_exports.enum(["tiny", "quick", "standard", "
 var mcpGptSafePulseDetailSchema = external_exports.enum(["tiny", "standard", "summary"]);
 var mcpPulseFormatSchema = external_exports.enum(["json", "markdown"]);
 var mcpPulseFreshnessSchema = external_exports.enum(["latest", "refresh"]);
-var mcpScanFromSchema = external_exports.enum(["eu_ie"]);
+var mcpScanFromSchema = external_exports.enum(["eu_ie", "eu_de", "california"]);
 var mcpCreateScanInputSchema = {
   url: external_exports.string().min(1).describe("Public URL or domain to scan."),
   detail: mcpPulseDetailSchema.optional().describe("Pulse detail level. Defaults to summary."),
@@ -18075,7 +18067,7 @@ var mcpGetLatestDomainPreConsentCookiesTrackersInputSchema = {
 };
 var scanCreationAnnotations = {
   readOnlyHint: false,
-  destructiveHint: false,
+  destructiveHint: true,
   idempotentHint: false,
   openWorldHint: true
 };
@@ -18274,8 +18266,6 @@ var preConsentCookiesTrackersExample = {
       name: "Example Analytics",
       vendor: "Example Analytics",
       host: "analytics.example.test",
-      domains: ["analytics.example.test"],
-      cookieNames: [],
       registrableDomain: "example.test",
       category: "Analytics",
       purpose: "Analytics",
@@ -18286,23 +18276,15 @@ var preConsentCookiesTrackersExample = {
       phase: "pre_consent",
       observedBeforeConsent: true,
       evidenceBasis: "public_report_projection",
-      attributionEvidence: {
-        signatureId: "domain_owner:example_analytics:analytics.example.test",
-        matchedOn: "domain",
-        matchedValue: "analytics.example.test"
-      },
-      syncedIdentifiers: [],
       firstObservedAtMs: 1234,
       pageUrlHost: "example.com"
     },
     {
-      id: "cookie:google:advertising:doubleclick-net:_ga",
+      id: "cookie:google:advertising:doubleclick-net",
       kind: "cookie",
       name: "Google",
       vendor: "Google",
       host: "doubleclick.net",
-      domains: ["doubleclick.net"],
-      cookieNames: ["_ga"],
       registrableDomain: "doubleclick.net",
       category: "Advertising",
       purpose: "Advertising",
@@ -18313,12 +18295,6 @@ var preConsentCookiesTrackersExample = {
       phase: "pre_consent",
       observedBeforeConsent: true,
       evidenceBasis: "public_report_projection",
-      attributionEvidence: {
-        signatureId: "cookie_google_ads_analytics",
-        matchedOn: "cookie_name",
-        matchedValue: "_ga"
-      },
-      syncedIdentifiers: [],
       firstObservedAtMs: 512,
       pageUrlHost: "example.com"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@certscore/mcp",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "mcpName": "ai.certscore/mcp",
   "private": false,
   "description": "MCP server for CertScore public website risk-signal workflows.",
@@ -17,6 +17,14 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/certscore-mcp.mjs"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
+    },
+    "./version": {
+      "types": "./dist/version.d.ts",
+      "import": "./dist/version.js"
     }
   },
   "files": [

package/server.json

@@ -2,17 +2,17 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "ai.certscore/mcp",
   "title": "CertScore MCP",
-  "description": "MCP server for CertScore public website risk-signal workflows, including scan creation, status checks, findings, bounded evidence, and latest-domain lookups. CertScore outputs are automated public-web observations for review, not legal advice, certification, or a compliance determination.",
+  "description": "CertScore website risk-signal tools for scans, findings, evidence, and latest-domain lookups.",
   "repository": {
     "url": "https://github.com/ergoveritas1-alt/certscore.ai",
     "source": "github"
   },
-  "version": "0.2.0",
+  "version": "0.2.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@certscore/mcp",
-      "version": "0.2.0",
+      "version": "0.2.2",
       "transport": {
         "type": "stdio"
       },
@@ -28,7 +28,7 @@
           "name": "CERTSCORE_BASE_URL",
           "description": "Optional CertScore API base URL. Defaults to https://certscore.ai.",
           "isRequired": false,
-          "format": "uri",
+          "format": "string",
           "isSecret": false
         }
       ]