@cognilead/mcp-server 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CogniLead
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,138 @@
+# @cognilead/mcp-server
+
+Model Context Protocol server for [CogniLead](https://cognilead.ai) —
+the managed cold-email deliverability engine for EU/technical B2B (plus AI
+content scaffolding). Exposes five tools to Cursor, Claude Desktop, Windsurf,
+and any MCP-capable client so you can draft outbound copy and run campaigns
+without leaving your IDE. All generation runs on phi-cloud as the LLM provider.
+
+Two tools are free (no API key, daily-capped). Three are gated behind a
+CogniLead API key — when the key is absent, the tool returns an inline
+signup URL so you can fix it in seconds.
+
+## Install
+
+```bash
+npm install -g @cognilead/mcp-server
+# or run on demand without installing
+npx -y @cognilead/mcp-server
+```
+
+The binary is `cognilead-mcp` and speaks the MCP stdio transport.
+
+## Configure your IDE
+
+### Cursor
+
+`~/.cursor/mcp.json` (or `.cursor/mcp.json` per-project):
+
+```json
+{
+  "mcpServers": {
+    "cognilead": {
+      "command": "npx",
+      "args": ["-y", "@cognilead/mcp-server"],
+      "env": {
+        "COGNILEAD_API_KEY": "pk_live_..."
+      }
+    }
+  }
+}
+```
+
+### Claude Desktop
+
+`~/Library/Application Support/Claude/claude_desktop_config.json` (macOS)
+or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):
+
+```json
+{
+  "mcpServers": {
+    "cognilead": {
+      "command": "npx",
+      "args": ["-y", "@cognilead/mcp-server"],
+      "env": {
+        "COGNILEAD_API_KEY": "pk_live_..."
+      }
+    }
+  }
+}
+```
+
+### Windsurf
+
+`~/.codeium/windsurf/mcp_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "cognilead": {
+      "command": "npx",
+      "args": ["-y", "@cognilead/mcp-server"],
+      "env": {
+        "COGNILEAD_API_KEY": "pk_live_..."
+      }
+    }
+  }
+}
+```
+
+Omit `COGNILEAD_API_KEY` to run in free-tier mode (only `draft_pitch`
+and `score_signal` are callable; the three gated tools return a 401 with
+an inline upgrade URL).
+
+## Tools
+
+| Tool | Tier | Daily cap | What it does |
+|---|---|---|---|
+| `cognilead.draft_pitch` | free | 20/day | Draft a short, personalised outbound pitch from the insight/context you feed it (the product, topic, and target account). |
+| `cognilead.score_signal` | free | 50/day | Score a supplied insight/context for fit against a target product (0-100, deterministic). |
+| `cognilead.ingest_lead` | gated | — | Register a (customer-supplied) lead in the outbound pipeline. |
+| `cognilead.run_campaign` | gated | — | Kick off an email campaign by id, optionally restricted to a set of leads. |
+| `cognilead.suppress` | gated | — | Add an email or domain to the suppression list (honours one-click RFC 8058 unsubscribe). |
+
+> Note: MarketPrior-fed targeting tools are **roadmap, not live**. Today you
+> supply leads/context yourself; CogniLead runs the deliverability.
+
+Free-tier quotas reset at UTC midnight and persist between IDE restarts
+in `~/.cognilead/quota.json`.
+
+## Environment
+
+| Var | Default | Purpose |
+|---|---|---|
+| `COGNILEAD_API_KEY` | _unset_ | Bearer token for gated tools |
+| `COGNILEAD_API_URL` | `https://api.cognilead.ai` | Override for self-hosted |
+| `COGNILEAD_SIGNUP_URL` | `https://cognilead.ai/signup?via=mcp` | Upgrade-hint URL |
+| `COGNILEAD_QUOTA_DIR` | `~/.cognilead` | Free-tier quota state directory |
+| `COGNILEAD_MCP_HTTP_PORT` | `8787` | Only used by the hosted-MCP HTTP variant |
+
+## Get a key
+
+[Sign up](https://cognilead.ai/signup?via=mcp) — the free tier ships with
+100 outbound sends per month plus capped AI content scaffolding. Paid plans add
+warmed sender pools, the reputation circuit-breaker, and reply/bounce handling.
+(MarketPrior-fed targeting is roadmap, not yet available.)
+
+## Local development
+
+```bash
+cd packages/mcp-server
+npm install
+npm run dev       # tsx src/index.ts (stdio)
+npm run build     # tsc → dist/
+npm run start     # node dist/index.js
+npm run start:http  # node dist/http.js — hosted-MCP HTTP variant
+```
+
+To test the binary doesn't crash on startup:
+
+```bash
+node packages/mcp-server/dist/index.js < /dev/null
+```
+
+It should exit cleanly when stdin closes.
+
+## License
+
+MIT

package/dist/api-client.d.ts

@@ -0,0 +1,7 @@
+export interface ApiError extends Error {
+    status: number;
+    body: unknown;
+}
+export declare function apiPost(path: string, body: unknown): Promise<unknown>;
+export declare function apiGet(path: string): Promise<unknown>;
+//# sourceMappingURL=api-client.d.ts.map

package/dist/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,QAAS,SAAQ,KAAK;IACrC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,OAAO,CAAA;CACd;AAuBD,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAY3E;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAW3D"}

package/dist/api-client.js

@@ -0,0 +1,50 @@
+// Minimal fetch wrapper for the hosted CogniLead API. No dependencies —
+// uses the global `fetch` available since Node 18.
+import { authHeaders } from './auth.js';
+import { loadConfig } from './config.js';
+function makeError(status, body, fallback) {
+    const message = (body && typeof body === 'object' && 'error' in body && typeof body.error === 'string'
+        ? body.error
+        : fallback) || fallback;
+    const err = new Error(message);
+    err.status = status;
+    err.body = body;
+    return err;
+}
+async function parseBody(res) {
+    const text = await res.text();
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+export async function apiPost(path, body) {
+    const { apiUrl } = loadConfig();
+    const res = await fetch(`${apiUrl}${path}`, {
+        method: 'POST',
+        headers: authHeaders(),
+        body: JSON.stringify(body ?? {}),
+    });
+    const data = await parseBody(res);
+    if (!res.ok) {
+        throw makeError(res.status, data, `POST ${path} failed (${res.status})`);
+    }
+    return data;
+}
+export async function apiGet(path) {
+    const { apiUrl } = loadConfig();
+    const res = await fetch(`${apiUrl}${path}`, {
+        method: 'GET',
+        headers: authHeaders(),
+    });
+    const data = await parseBody(res);
+    if (!res.ok) {
+        throw makeError(res.status, data, `GET ${path} failed (${res.status})`);
+    }
+    return data;
+}
+//# sourceMappingURL=api-client.js.map

package/dist/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,mDAAmD;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAOxC,SAAS,SAAS,CAAC,MAAc,EAAE,IAAa,EAAE,QAAgB;IAChE,MAAM,OAAO,GACX,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QACpF,CAAC,CAAC,IAAI,CAAC,KAAK;QACZ,CAAC,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAA;IAC3B,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAa,CAAA;IAC1C,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;IACnB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;IACf,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAa;IACpC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,IAAa;IACvD,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,CAAA;IAC/B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE;QAC1C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,WAAW,EAAE;QACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;KACjC,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,IAAI,YAAY,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAY;IACvC,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,CAAA;IAC/B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE;QAC1C,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,WAAW,EAAE;KACvB,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,IAAI,YAAY,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/auth.d.ts

@@ -0,0 +1,25 @@
+export declare class McpAuthError extends Error {
+    readonly code = "mcp.unauthenticated";
+    constructor(message: string);
+}
+export declare class McpQuotaError extends Error {
+    readonly code = "mcp.quota_exceeded";
+    constructor(message: string);
+}
+/**
+ * Client-side fail-fast check. Throws when no API key is configured so
+ * gated tools surface a useful error before any network I/O. The hosted
+ * /api/v1/* surface is the authoritative gate — skipping this check
+ * just means the developer sees a generic 401 instead of the curated
+ * message below.
+ */
+export declare function assertGatedAccess(): string;
+/**
+ * Header bag for the hosted API. Every gated tool MUST route through
+ * this when it talks to the hosted /api/v1/* surface — the Bearer token
+ * is what the server's withAuth() wrapper verifies before letting the
+ * call hit the repo. Without it the server returns 401 regardless of
+ * what the client-side assertGatedAccess() said.
+ */
+export declare function authHeaders(): Record<string, string>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAoBA,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,yBAAwB;gBACzB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,wBAAuB;gBACxB,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAQ1C;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOpD"}

package/dist/auth.js

@@ -0,0 +1,62 @@
+// Auth gate for the gated tools.
+//
+// IMPORTANT (closes strategic-review finding #3): the *real* auth gate
+// is now server-side at /api/v1/* in the hosted CogniLead service —
+// each route handler wraps in withAuth() and rejects requests that
+// don't carry a valid `Authorization: Bearer pk_live_…` header.
+//
+// The client-side assertGatedAccess() check below is retained purely
+// for UX: it fails fast with a curated error message + signup link
+// BEFORE any network call so the developer experience is "you forgot
+// to set COGNILEAD_API_KEY" instead of "401 from the server" with no
+// next step. Skipping or spoofing this check has no security impact —
+// every call eventually has to satisfy the server.
+//
+// The error message is intentionally verbatim from the strategic plan
+// — IDEs surface this string directly to developers and it doubles as
+// the acquisition copy.
+import { loadConfig } from './config.js';
+export class McpAuthError extends Error {
+    code = 'mcp.unauthenticated';
+    constructor(message) {
+        super(message);
+        this.name = 'McpAuthError';
+    }
+}
+export class McpQuotaError extends Error {
+    code = 'mcp.quota_exceeded';
+    constructor(message) {
+        super(message);
+        this.name = 'McpQuotaError';
+    }
+}
+/**
+ * Client-side fail-fast check. Throws when no API key is configured so
+ * gated tools surface a useful error before any network I/O. The hosted
+ * /api/v1/* surface is the authoritative gate — skipping this check
+ * just means the developer sees a generic 401 instead of the curated
+ * message below.
+ */
+export function assertGatedAccess() {
+    const cfg = loadConfig();
+    if (!cfg.apiKey) {
+        throw new McpAuthError(`This tool requires a CogniLead API key. Get one at ${cfg.signupUrl} (free for 100 sends/mo).`);
+    }
+    return cfg.apiKey;
+}
+/**
+ * Header bag for the hosted API. Every gated tool MUST route through
+ * this when it talks to the hosted /api/v1/* surface — the Bearer token
+ * is what the server's withAuth() wrapper verifies before letting the
+ * call hit the repo. Without it the server returns 401 regardless of
+ * what the client-side assertGatedAccess() said.
+ */
+export function authHeaders() {
+    const apiKey = assertGatedAccess();
+    return {
+        Authorization: `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+        'User-Agent': 'cognilead-mcp/0.1.0',
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,uEAAuE;AACvE,oEAAoE;AACpE,mEAAmE;AACnE,gEAAgE;AAChE,EAAE;AACF,qEAAqE;AACrE,mEAAmE;AACnE,qEAAqE;AACrE,qEAAqE;AACrE,sEAAsE;AACtE,mDAAmD;AACnD,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,wBAAwB;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,GAAG,qBAAqB,CAAA;IACrC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,GAAG,oBAAoB,CAAA;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;IAC7B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;IACxB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,YAAY,CACpB,sDAAsD,GAAG,CAAC,SAAS,2BAA2B,CAC/F,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAA;IAClC,OAAO;QACL,aAAa,EAAE,UAAU,MAAM,EAAE;QACjC,cAAc,EAAE,kBAAkB;QAClC,YAAY,EAAE,qBAAqB;KACpC,CAAA;AACH,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,14 @@
+export interface McpConfig {
+    apiKey: string | null;
+    apiUrl: string;
+    signupUrl: string;
+    /**
+     * Directory where best-effort quota state is persisted. Defaults to
+     * `~/.cognilead`. We fail-open if this path isn't writable.
+     */
+    quotaDir: string;
+    /** Hosted MCP HTTP port (only used by src/http.ts). */
+    httpPort: number;
+}
+export declare function loadConfig(): McpConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAOD,wBAAgB,UAAU,IAAI,SAAS,CAYtC"}

package/dist/config.js

@@ -0,0 +1,21 @@
+// Runtime config. Read from env so the package stays portable when it's
+// later published as a standalone npm bin.
+//
+// COGNILEAD_API_KEY  — required for gated tools; absent ⇒ free tier only.
+// COGNILEAD_API_URL  — defaults to production; override for self-hosted.
+// COGNILEAD_SIGNUP_URL — the upgrade hint URL shown in 401 errors.
+function defaultQuotaDir() {
+    const home = process.env.HOME ?? process.env.USERPROFILE ?? '/tmp';
+    return `${home}/.cognilead`;
+}
+export function loadConfig() {
+    return {
+        apiKey: process.env.COGNILEAD_API_KEY?.trim() || null,
+        apiUrl: (process.env.COGNILEAD_API_URL ?? 'https://api.cognilead.ai').replace(/\/+$/, ''),
+        signupUrl: process.env.COGNILEAD_SIGNUP_URL ??
+            'https://cognilead.ai/signup?via=mcp',
+        quotaDir: process.env.COGNILEAD_QUOTA_DIR ?? defaultQuotaDir(),
+        httpPort: Number(process.env.COGNILEAD_MCP_HTTP_PORT ?? 8787),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,2CAA2C;AAC3C,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,mEAAmE;AAenE,SAAS,eAAe;IACtB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAA;IAClE,OAAO,GAAG,IAAI,aAAa,CAAA;AAC7B,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI;QACrD,MAAM,EAAE,CACN,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,0BAA0B,CAC5D,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACrB,SAAS,EACP,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAChC,qCAAqC;QACvC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,eAAe,EAAE;QAC9D,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,IAAI,CAAC;KAC9D,CAAA;AACH,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,5 @@
+export declare function startHttpServer(port?: number): Promise<{
+    port: number;
+    close: () => Promise<void>;
+}>;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAmIA,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAkCpG"}

package/dist/http.js

@@ -0,0 +1,169 @@
+// HTTP variant — Phase 2 hosted MCP at mcp.cognilead.ai.
+//
+// Implements two endpoints over Node's built-in http module (no Express
+// dep):
+//   POST /mcp/v1/tools/list  → { tools: ToolSpec[] }
+//   POST /mcp/v1/tools/call  → { content?, isError?, error? }
+//
+// Gated tools require Bearer auth (COGNILEAD_API_KEY on the server side
+// is overridden by the inbound Authorization header for the duration of
+// the request via process.env mutation — single-process only, fine for
+// the placeholder).
+//
+// This file is forward-looking. It must compile and start without
+// crashing. Real hosted MCP gets a proper auth layer in Phase 2.
+import { createServer as createHttpServer } from 'node:http';
+import { TOOLS } from './index.js';
+import { loadConfig } from './config.js';
+import { McpAuthError, McpQuotaError } from './auth.js';
+const FREE_TOOLS = new Set(['cognilead.draft_pitch', 'cognilead.score_signal']);
+async function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on('data', (c) => chunks.push(c));
+        req.on('end', () => {
+            const raw = Buffer.concat(chunks).toString('utf8');
+            if (!raw)
+                return resolve(null);
+            try {
+                resolve(JSON.parse(raw));
+            }
+            catch (e) {
+                reject(e);
+            }
+        });
+        req.on('error', reject);
+    });
+}
+function sendJson(res, status, body) {
+    const buf = Buffer.from(JSON.stringify(body), 'utf8');
+    res.writeHead(status, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Content-Length': buf.byteLength.toString(),
+    });
+    res.end(buf);
+}
+function extractBearer(req) {
+    const h = req.headers.authorization ?? '';
+    const m = /^Bearer\s+(.+)$/i.exec(h);
+    return m ? m[1].trim() : null;
+}
+function formatError(e) {
+    if (e instanceof McpAuthError) {
+        return { code: e.code, message: e.message, upgrade_url: loadConfig().signupUrl };
+    }
+    if (e instanceof McpQuotaError) {
+        return { code: e.code, message: e.message };
+    }
+    if (e instanceof Error) {
+        return { code: 'mcp.tool_error', message: e.message };
+    }
+    return { code: 'mcp.unknown', message: String(e) };
+}
+async function handleListTools(_req, res) {
+    sendJson(res, 200, {
+        tools: TOOLS.map((t) => ({
+            name: t.name,
+            description: t.description,
+            inputSchema: t.inputSchema,
+        })),
+    });
+}
+async function handleCallTool(req, res) {
+    let body;
+    try {
+        body = (await readBody(req));
+    }
+    catch (e) {
+        return sendJson(res, 400, { error: { code: 'mcp.bad_request', message: e.message } });
+    }
+    const name = body?.name;
+    if (!name || typeof name !== 'string') {
+        return sendJson(res, 400, {
+            error: { code: 'mcp.bad_request', message: 'missing tool name' },
+        });
+    }
+    const tool = TOOLS.find((t) => t.name === name);
+    if (!tool) {
+        return sendJson(res, 404, {
+            error: { code: 'mcp.unknown_tool', message: `Unknown tool: ${name}` },
+        });
+    }
+    // Auth shim: if a Bearer header is present, surface it as
+    // COGNILEAD_API_KEY for the duration of this request. This is single-
+    // process and not concurrency-safe — Phase 2 will inject via request
+    // context instead.
+    const bearer = extractBearer(req);
+    const prior = process.env.COGNILEAD_API_KEY;
+    if (bearer)
+        process.env.COGNILEAD_API_KEY = bearer;
+    if (!bearer && !FREE_TOOLS.has(name)) {
+        sendJson(res, 401, {
+            error: {
+                code: 'mcp.unauthenticated',
+                message: `This tool requires a CogniLead API key. Get one at ${loadConfig().signupUrl} (free for 100 sends/mo).`,
+                upgrade_url: loadConfig().signupUrl,
+            },
+        });
+        return;
+    }
+    try {
+        const result = await tool.handler(body?.arguments ?? {});
+        sendJson(res, 200, { content: [{ type: 'text', text: JSON.stringify(result) }] });
+    }
+    catch (e) {
+        const payload = formatError(e);
+        const status = payload.code === 'mcp.unauthenticated' ? 401 : payload.code === 'mcp.quota_exceeded' ? 429 : 500;
+        sendJson(res, status, { isError: true, error: payload });
+    }
+    finally {
+        if (bearer) {
+            if (prior === undefined)
+                delete process.env.COGNILEAD_API_KEY;
+            else
+                process.env.COGNILEAD_API_KEY = prior;
+        }
+    }
+}
+export function startHttpServer(port) {
+    const p = port ?? loadConfig().httpPort;
+    const srv = createHttpServer(async (req, res) => {
+        // Always respond JSON, even for unknown routes.
+        res.setHeader('Access-Control-Allow-Origin', '*');
+        res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type');
+        if (req.method === 'OPTIONS') {
+            res.writeHead(204).end();
+            return;
+        }
+        if (req.method !== 'POST') {
+            return sendJson(res, 405, { error: { code: 'mcp.method_not_allowed' } });
+        }
+        const url = req.url ?? '';
+        if (url === '/mcp/v1/tools/list')
+            return handleListTools(req, res);
+        if (url === '/mcp/v1/tools/call')
+            return handleCallTool(req, res);
+        return sendJson(res, 404, { error: { code: 'mcp.not_found' } });
+    });
+    return new Promise((resolve) => {
+        srv.listen(p, () => {
+            const addr = srv.address();
+            const actualPort = typeof addr === 'object' && addr ? addr.port : p;
+            process.stderr.write(`[cognilead-mcp-http] listening on :${actualPort}\n`);
+            resolve({
+                port: actualPort,
+                close: () => new Promise((r, reject) => srv.close((e) => (e ? reject(e) : r()))),
+            });
+        });
+    });
+}
+// Run only when invoked directly.
+const isDirect = import.meta.url === `file://${process.argv[1]}` || process.argv[1]?.endsWith('/http.js');
+if (isDirect) {
+    startHttpServer().catch((err) => {
+        process.stderr.write(`[cognilead-mcp-http] fatal: ${err.message}\n`);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,wEAAwE;AACxE,QAAQ;AACR,qDAAqD;AACrD,8DAA8D;AAC9D,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,oBAAoB;AACpB,EAAE;AACF,kEAAkE;AAClE,iEAAiE;AAEjE,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAA6C,MAAM,WAAW,CAAA;AAEvG,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAEvD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,uBAAuB,EAAE,wBAAwB,CAAC,CAAC,CAAA;AAEvF,KAAK,UAAU,QAAQ,CAAC,GAAoB;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAClD,IAAI,CAAC,GAAG;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YAC1B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,CAAC,CAAC,CAAA;YACX,CAAC;QACH,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;IACrD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,iCAAiC;QACjD,gBAAgB,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE;KAC5C,CAAC,CAAA;IACF,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED,SAAS,aAAa,CAAC,GAAoB;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IACzC,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACpC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,CAAC,YAAY,YAAY,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,CAAA;IAClF,CAAC;IACD,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;IAC7C,CAAC;IACD,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;IACvD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;AACpD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAqB,EAAE,GAAmB;IACvE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;QACjB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC;KACJ,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAoB,EAAE,GAAmB;IACrE,IAAI,IAAmD,CAAA;IACvD,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAgB,CAAA;IAC7C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IAClG,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAA;IACvB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,mBAAmB,EAAE;SACjE,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;IAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACxB,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE;SACtE,CAAC,CAAA;IACJ,CAAC;IAED,0DAA0D;IAC1D,sEAAsE;IACtE,qEAAqE;IACrE,mBAAmB;IACnB,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAA;IAC3C,IAAI,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAA;IAClD,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACjB,KAAK,EAAE;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,sDAAsD,UAAU,EAAE,CAAC,SAAS,2BAA2B;gBAChH,WAAW,EAAE,UAAU,EAAE,CAAC,SAAS;aACpC;SACF,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAA;QACxD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IACnF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;QAC/G,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1D,CAAC;YAAS,CAAC;QACT,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAA;;gBACxD,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,KAAK,CAAA;QAC5C,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,MAAM,CAAC,GAAG,IAAI,IAAI,UAAU,EAAE,CAAC,QAAQ,CAAA;IACvC,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,gDAAgD;QAChD,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;QACjD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAA;QAC9D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAA;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;YACxB,OAAM;QACR,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,EAAE,CAAC,CAAA;QAC1E,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAA;QACzB,IAAI,GAAG,KAAK,oBAAoB;YAAE,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAClE,IAAI,GAAG,KAAK,oBAAoB;YAAE,OAAO,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACjE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE;YACjB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAA;YAC1B,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,UAAU,IAAI,CAAC,CAAA;YAC1E,OAAO,CAAC;gBACN,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC9B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CACxC;aACJ,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,kCAAkC;AAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAA;AACzG,IAAI,QAAQ,EAAE,CAAC;IACb,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAAgC,GAAa,CAAC,OAAO,IAAI,CAAC,CAAA;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+interface ToolSpec {
+    name: string;
+    description: string;
+    inputSchema: unknown;
+    handler: (input: unknown) => Promise<unknown>;
+}
+export declare const TOOLS: ToolSpec[];
+export declare function createServer(): Server;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAaA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAA;AA8BlE,UAAU,QAAQ;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC9C;AAED,eAAO,MAAM,KAAK,EAAE,QAAQ,EA2C3B,CAAA;AAiCD,wBAAgB,YAAY,IAAI,MAAM,CAmDrC"}