@cyanheads/openfec-mcp-server 0.4.3 → 0.4.5

package/CLAUDE.md

@@ -1,8 +1,8 @@
 # Agent Protocol
 
 **Server:** openfec-mcp-server
-**Version:** 0.4.2
-**Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.8.19`
+**Version:** 0.4.5
+**Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.9.6`
 **Engines:** Bun ≥1.3.0, Node ≥24.0.0
 
 > **Read the framework docs first:** `node_modules/@cyanheads/mcp-ts-core/CLAUDE.md` contains the full API reference — builders, Context, error codes, exports, patterns. This file covers server-specific conventions only.
@@ -151,7 +151,7 @@ export const moneyTrailPrompt = prompt('openfec_money_trail', {
 import { parseEnvConfig } from '@cyanheads/mcp-ts-core/config';
 
 const ServerConfigSchema = z.object({
-  fecApiKey: z.string().min(1, 'FEC_API_KEY is required.'),
+  fecApiKey: z.string().default('DEMO_KEY').describe('OpenFEC API key — optional (DEMO_KEY: 30 req/hr, own key: 1000 req/hr)'),
   fecBaseUrl: z.string().default('https://api.open.fec.gov/v1').describe('OpenFEC API base URL'),
   fecMaxRetries: z.coerce.number().int().min(0).default(3).describe('Max retry attempts'),
   fecRequestTimeout: z.coerce.number().int().min(1000).default(30_000).describe('Request timeout in ms'),
@@ -317,9 +317,13 @@ When you complete a skill's checklist, check the boxes and add a completion time
 | `bun run rebuild` | Clean + build |
 | `bun run clean` | Remove build artifacts |
 | `bun run devcheck` | Lint + format + typecheck + security |
+| `bun run audit:refresh` | Delete `bun.lock`, reinstall, re-audit. Use when `devcheck` flags a transitive advisory — stale lockfile can mask already-patched deps. If advisory survives, it's real. |
 | `bun run tree` | Generate directory structure doc |
 | `bun run format` | Auto-fix formatting |
 | `bun run lint:mcp` | Validate MCP tool/resource/prompt definitions |
+| `bun run lint:packaging` | Validate `manifest.json` + `server.json` env var alignment |
+| `bun run list-skills` | Print index of available project skills |
+| `bun run bundle` | Build and pack as `.mcpb` for one-click Claude Desktop install |
 | `bun run test` | Run tests |
 | `bun run start` | Production mode (transport from `MCP_TRANSPORT_TYPE`) |
 | `bun run start:stdio` | Production mode (stdio) |
@@ -329,6 +333,14 @@ For dev / smoke-testing, use `bun run rebuild && bun run start:stdio` (or `start
 
 ---
 
+## Bundling
+
+`bun run bundle` produces a `.mcpb` extension bundle for one-click install in Claude Desktop. MCPB is stdio-only — HTTP deployments are unaffected. If you don't need it, delete `manifest.json` and `.mcpbignore`; `lint:packaging` skips cleanly.
+
+**Adding an env var requires both files:** `server.json` (registry discovery, `environmentVariables[]`) and `manifest.json` (bundle install UX, `mcp_config.env` + `user_config`). `lint:packaging` (run by `devcheck`) verifies the env var names match.
+
+---
+
 ## Publishing
 
 Run the `release-and-publish` skill for the full flow (verification gate, push, npm + MCP Registry + GHCR). Reference commands:
@@ -359,12 +371,15 @@ import { getOpenFecService } from '@/services/openfec/openfec-service.js';
 
 ## Checklist
 
-- [ ] Zod schemas: all fields have `.describe()` (including nested object fields and array element types), only JSON-Schema-serializable types (no `z.custom()`, `z.date()`, `z.transform()`, `z.bigint()`, `z.symbol()`, `z.void()`, `z.map()`, `z.set()`, `z.function()`, `z.nan()`)
-- [ ] Optional nested objects: handler guards for empty inner values from form-based clients (`if (input.obj?.field && ...)`, not just `if (input.obj)`)
+- [ ] Zod schemas: all fields have `.describe()` (including nested object fields and array element types), only JSON-Schema-serializable types (no `z.custom()`, `z.date()`, `z.transform()`, `z.bigint()`, `z.symbol()`, `z.void()`, `z.map()`, `z.set()`, `z.function()`, `z.nan()`); avoid non-portable `format` emitters (`z.url()`, `z.cuid()`, `z.ulid()`, `z.nanoid()`, `z.base64()`, `z.jwt()`) — use `z.string()` with the constraint in `.describe()`
+- [ ] Optional nested objects: handler guards for empty inner values from form-based clients (`if (input.obj?.field && ...)`, not just `if (input.obj)`). When regex/length constraints matter, use `z.union([z.literal(''), z.string().regex(...).describe(...)])` — literal variants are exempt from `describe-on-fields`.
 - [ ] JSDoc `@fileoverview` + `@module` on every file
 - [ ] `ctx.log` for logging, `ctx.state` for storage
 - [ ] Handlers throw on failure — error factories or plain `Error`, no try/catch
 - [ ] `format()` renders all data the LLM needs — different clients forward different surfaces (Claude Code → `structuredContent`, Claude Desktop → `content[]`); both must carry the same data
+- [ ] Wrapping the OpenFEC API: raw/domain/output schemas reviewed against real upstream sparsity/nullability before finalizing required vs optional fields
+- [ ] Wrapping the OpenFEC API: normalization and `format()` preserve uncertainty; do not fabricate facts from missing upstream data
+- [ ] Wrapping the OpenFEC API: tests include at least one sparse payload case with omitted upstream fields
 - [ ] Registered in `createApp()` arrays (directly or via barrel exports)
 - [ ] Tests use `createMockContext()` from `@cyanheads/mcp-ts-core/testing`
 - [ ] `bun run devcheck` passes

package/README.md

@@ -1,14 +1,21 @@
 <div align="center">
   <h1>@cyanheads/openfec-mcp-server</h1>
-  <p><b>Access FEC campaign finance data through MCP. Query data about candidates, money trails, and election filings. STDIO & Streamable HTTP.</b></p>
-  <p><b>9 Tools · 5 Resources · 2 Prompts</b></p>
+  <p><b>Access FEC campaign finance data through MCP. Query data about candidates, money trails, and election filings. STDIO & Streamable HTTP.</b>
+  <div>9 Tools • 5 Resources • 2 Prompts</div>
+  </p>
 </div>
 
 <div align="center">
 
-[![npm](https://img.shields.io/npm/v/@cyanheads/openfec-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/@cyanheads/openfec-mcp-server) [![Version](https://img.shields.io/badge/Version-0.4.3-blue.svg?style=flat-square)](./CHANGELOG.md) [![Framework](https://img.shields.io/badge/Built%20on-@cyanheads/mcp--ts--core-259?style=flat-square)](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^1.29.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/) 
+[![npm](https://img.shields.io/npm/v/@cyanheads/openfec-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/@cyanheads/openfec-mcp-server) [![Version](https://img.shields.io/badge/Version-0.4.5-blue.svg?style=flat-square)](./CHANGELOG.md) [![Docker](https://img.shields.io/badge/Docker-ghcr.io-2496ED?style=flat-square&logo=docker&logoColor=white)](https://github.com/users/cyanheads/packages/container/package/openfec-mcp-server) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^1.29.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![TypeScript](https://img.shields.io/badge/TypeScript-^6.0.3-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-^1.3.0-f9f1e1.svg?style=flat-square)](https://bun.sh/)
 
-[![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![TypeScript](https://img.shields.io/badge/TypeScript-^6.0.3-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-^1.3.0-f9f1e1.svg?style=flat-square)](https://bun.sh/)
+</div>
+
+<div align="center">
+
+[![Install in Claude Desktop](https://img.shields.io/badge/Install_in-Claude_Desktop-D97757?style=for-the-badge&logo=anthropic&logoColor=white)](https://github.com/cyanheads/openfec-mcp-server/releases/latest/download/openfec-mcp-server.mcpb)
+
+[![Framework](https://img.shields.io/badge/Built%20on-@cyanheads/mcp--ts--core-67E8F9?style=flat-square)](https://www.npmjs.com/package/@cyanheads/mcp-ts-core)
 
 </div>
 
@@ -233,8 +240,8 @@ MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 FEC_API_KEY=your-key bun run start:ht
 
 ### Prerequisites
 
-- [Bun v1.2.0](https://bun.sh/) or higher
-- A free [OpenFEC API key](https://api.data.gov/signup/)
+- [Bun v1.3.0](https://bun.sh/) or higher (or Node ≥24)
+- (Optional) A free [OpenFEC API key](https://api.data.gov/signup/) for higher rate limits (1,000 req/hr vs 30 req/hr with the default `DEMO_KEY`)
 
 ### Installation
 
@@ -260,7 +267,7 @@ bun install
 
 | Variable | Description | Default |
 |:---------|:------------|:--------|
-| `FEC_API_KEY` | **Required.** OpenFEC API key. Get one free at [api.data.gov/signup](https://api.data.gov/signup/). | — |
+| `FEC_API_KEY` | OpenFEC API key. Optional — defaults to `DEMO_KEY` (30 req/hr). Provide your own key (free at [api.data.gov/signup](https://api.data.gov/signup/)) for 1,000 req/hr. | `DEMO_KEY` |
 | `FEC_BASE_URL` | OpenFEC API base URL. | `https://api.open.fec.gov/v1` |
 | `FEC_MAX_RETRIES` | Max retry attempts for failed API requests. | `3` |
 | `FEC_REQUEST_TIMEOUT` | Request timeout in milliseconds. | `30000` |
@@ -271,27 +278,22 @@ bun install
 | `MCP_LOG_LEVEL` | Log level (RFC 5424). | `info` |
 | `LOGS_DIR` | Directory for log files (Node.js only). | `<project-root>/logs` |
 | `STORAGE_PROVIDER_TYPE` | Storage backend. | `in-memory` |
-| `OTEL_ENABLED` | Enable OpenTelemetry tracing. | `false` |
+| `OTEL_ENABLED` | Enable [OpenTelemetry instrumentation](https://github.com/cyanheads/mcp-ts-core/tree/main/docs/telemetry) (spans, metrics, completion logs). | `false` |
 
 ## Running the Server
 
 ### Local Development
 
-- **Build and run the production version:**
-  ```sh
-  bun run build
-  bun run start:http   # or start:stdio
-  ```
-
-- **Run in dev mode (with watch):**
+- **Build and run:**
   ```sh
-  bun run dev:stdio    # or dev:http
+  bun run rebuild
+  bun run start:stdio   # or start:http
   ```
 
 - **Run checks and tests:**
   ```sh
-  bun run devcheck     # Lints, formats, type-checks
-  bun run test         # Runs test suite
+  bun run devcheck      # Lint, format, typecheck, security audit
+  bun run test          # Runs test suite
   ```
 
 ## Project Structure

package/changelog/0.1.x/0.1.0.md

@@ -0,0 +1,31 @@
+---
+summary: "Initial release: 9 tools, 3 resources, 2 prompts for FEC campaign finance data. STDIO and Streamable HTTP."
+breaking: false
+security: false
+---
+
+# 0.1.0 — 2026-04-04
+
+## Added
+
+- 9 tools for querying federal election campaign finance data:
+  - `openfec_search_candidates` — find candidates by name, state, office, party, or cycle
+  - `openfec_search_committees` — find committees by name, type, or candidate affiliation
+  - `openfec_search_contributions` — itemized individual contributions and aggregate breakdowns
+  - `openfec_search_disbursements` — itemized committee spending and aggregate breakdowns
+  - `openfec_search_expenditures` — independent expenditures supporting or opposing candidates
+  - `openfec_search_filings` — FEC filings and reports by form type, committee, or date
+  - `openfec_lookup_elections` — election races and candidate financial summaries
+  - `openfec_search_legal` — advisory opinions, enforcement cases, and administrative fines
+  - `openfec_lookup_calendar` — FEC calendar events, filing deadlines, and election dates
+- 3 resources for direct entity lookup:
+  - `openfec://candidate/{candidate_id}` — candidate profile with financial totals
+  - `openfec://committee/{committee_id}` — committee profile with financial summary
+  - `openfec://election/{cycle}/{office}` — election race summary
+- 2 prompts for guided campaign finance analysis:
+  - `openfec_campaign_analysis` — structured candidate financial position analysis
+  - `openfec_money_trail` — multi-tool money flow investigation framework
+- OpenFEC API service with retry logic, configurable timeout, and type-safe client.
+- STDIO and Streamable HTTP transport support.
+- Docker deployment with OCI labels.
+- Built on `@cyanheads/mcp-ts-core` framework.

package/changelog/0.2.x/0.2.0.md

@@ -0,0 +1,35 @@
+---
+summary: "Election resource split into 3 URI templates with explicit params; API key sanitization; HTTP status enrichment; legal search trimming."
+breaking: true
+security: false
+---
+
+# 0.2.0 — 2026-04-04
+
+## Changed
+
+- **Breaking:** Split election resource into 3 URI templates with explicit params:
+  - `openfec://election/{cycle}/{office}` — presidential/at-large races
+  - `openfec://election/{cycle}/{office}/{state}` — senate/state races
+  - `openfec://election/{cycle}/{office}/{state}/{district}` — house district races
+  - State and district are now explicit params instead of parsed from the URI path.
+- Election summary mode returns a flat aggregate object (`count`, `receipts`, `disbursements`, `independent_expenditures`) instead of a paginated response.
+- All empty-result format messages now include actionable troubleshooting suggestions.
+- Candidate ID regex relaxed to accept alphanumeric suffixes (`[HSP][0-9A-Z]+`).
+
+## Fixed
+
+- Calendar tool date parameters now map to correct endpoint-specific field names (`min_start_date`/`max_start_date` for events, `min_due_date`/`max_due_date` for filing deadlines, `min_election_date`/`max_election_date` for election dates).
+
+## Added
+
+- API error sanitization: API keys are stripped from error messages before surfacing to clients.
+- HTTP status errors enriched with actionable hints (rate limits, bad params, service unavailable).
+- Legal search response trimming for LLM context windows (highlights capped at 3, documents summarized as count + categories, commission votes condensed).
+- `NotFound` errors for candidate and committee ID-specific lookups that return empty results.
+- Expenditure tool validates candidate/committee ID formats and requires `candidate_id` for `by_candidate` mode.
+- `ElectionSummary` type for the flat `/elections/summary/` endpoint response.
+- Defensive null coalescing on pagination fields in service layer.
+- Security overrides for transitive dependencies (`brace-expansion`, `express-rate-limit`, `hono`, `path-to-regexp`, `picomatch`, `yaml`, `lodash`).
+- Funding info, author email, and `typescript`/`ai-agent` keywords to package.json.
+- Consistent `bun run` prefix for all package scripts; start scripts use `bun` runtime.

package/changelog/0.2.x/0.2.1.md

@@ -0,0 +1,21 @@
+---
+summary: "Tool export renames; FecParams multi-value support; calendar category param; disbursements committee_id required; shared format-helpers and id-validators."
+breaking: false
+security: false
+---
+
+# 0.2.1 — 2026-04-04
+
+## Changed
+
+- Renamed tool exports for consistency: `lookupCalendarTool` → `lookupCalendar`, `lookupElectionsTool` → `lookupElections`, `searchLegalTool` → `searchLegal`.
+- `FecParams` type now supports `string[]` values for repeated query parameters (e.g., multiple `candidate_id` values).
+- `search-candidates` tool sends multi-candidate totals lookups as repeated query params instead of comma-separated strings.
+- Calendar tool `report_type` parameter scoped to filing deadlines mode only; added dedicated `category` parameter for calendar category filtering in events mode.
+- Disbursements tool `committee_id` enforced as required via `.min(1)` schema constraint instead of runtime guard.
+
+## Added
+
+- Shared `utils/format-helpers.ts` — extracted `fmt$`, `str`, and `PaginationSchema` from duplicated inline definitions across tools.
+- Shared `utils/id-validators.ts` — extracted `validateCandidateId` and `validateCommitteeId` with consistent error messages.
+- Contributions tool now validates `candidate_id` and `committee_id` format before API calls.

package/changelog/0.2.x/0.2.2.md

@@ -0,0 +1,16 @@
+---
+summary: "Legal search respondent param fix (respondent → case_respondents); STDIO & HTTP transport mention in description."
+breaking: false
+security: false
+---
+
+# 0.2.2 — 2026-04-04
+
+## Fixed
+
+- Legal search `respondent` parameter now maps to the correct API field (`case_respondents` instead of `respondent`).
+
+## Changed
+
+- Server description updated to mention STDIO & Streamable HTTP transport support (server.json, Dockerfile OCI label).
+- Removed stale `ctx.elicit`/`ctx.sample` guidance from CLAUDE.md.

package/changelog/0.2.x/0.2.3.md

@@ -0,0 +1,13 @@
+---
+summary: "Public hosted instance at openfec.caseyjhand.com/mcp; server.json remotes field."
+breaking: false
+security: false
+---
+
+# 0.2.3 — 2026-04-04
+
+## Added
+
+- Public hosted instance at `https://openfec.caseyjhand.com/mcp` — no API key or installation required.
+- `remotes` field in `server.json` advertising the Streamable HTTP endpoint for MCP client discovery.
+- "Public Hosted Instance" section in README Getting Started with connection config example.

package/changelog/0.3.x/0.3.0.md

@@ -0,0 +1,28 @@
+---
+summary: "Format output overhaul (renderRecord helper); election ZIP support; calendar/disbursement sort defaults; error sanitization fix."
+breaking: false
+security: false
+---
+
+# 0.3.0 — 2026-04-04
+
+## Changed
+
+- **Format output overhaul:** All tool `format()` functions now use a shared `renderRecord()` helper instead of bespoke field-by-field rendering — text output shows raw field names (`total_receipts:`) instead of human-readable labels (`Receipts:`).
+- Prompt descriptions switched from `+` string concatenation to template literals.
+- Contribution aggregates now default to `sort: '-total', sort_hide_null: true` for more useful ordering.
+- Disbursement aggregates likewise default to descending-total sort.
+- Legal search `type` description warns that `admin_fines` is slow without a query or respondent filter.
+- Elections tool relaxes state/district requirements when a ZIP code is provided; summary mode rejects ZIP lookups with an explicit error.
+- `enrichStatusError()` now sanitizes the error message before pattern-matching HTTP status codes (avoids double-sanitization).
+
+## Added
+
+- `renderRecord()` in `utils/format-helpers.ts` — generic key/value renderer with skip-set for header fields.
+- `searchElectionsByZip()` service method using the `/elections/search/` endpoint which accepts ZIP parameters.
+- Candidate resource handler validates candidate ID format before API call.
+- `FETCH_TIMEOUT` recognized as transient error for retry logic.
+
+## Fixed
+
+- `enrichStatusError()` was sanitizing twice in the hint branch; now sanitizes once upfront.

package/changelog/0.3.x/0.3.1.md

@@ -0,0 +1,16 @@
+---
+summary: "Search criteria echo on empty results across all 9 tools; shared buildSearchCriteria/formatEmptyResult helpers."
+breaking: false
+security: false
+---
+
+# 0.3.1 — 2026-04-04
+
+## Added
+
+- Search criteria echo on empty results — all 9 tools now return the filters that produced zero matches, helping diagnose why a query returned nothing.
+- `buildSearchCriteria()`, `formatEmptyResult()`, and `SearchCriteriaSchema` in `format-helpers.ts` for consistent empty-result rendering across tools.
+
+## Changed
+
+- Empty-result format messages unified to "No results found" with echoed criteria and domain-specific suggestions (previously each tool had a bespoke message).

package/changelog/0.3.x/0.3.2.md

@@ -0,0 +1,14 @@
+---
+summary: "mcp-ts-core ^0.3.8: 15 skills synced, devDep bumps, description string literal cleanup, candidate resource ID validation."
+breaking: false
+security: false
+---
+
+# 0.3.2 — 2026-04-19
+
+## Changed
+
+- Upgraded `@cyanheads/mcp-ts-core` from 0.2.12 to 0.3.8 and synced 15 project skills; added new `add-app-tool` skill.
+- Bumped devDependencies to latest: `@biomejs/biome` 2.4.12, `@types/node` 25.6.0, `typescript` 6.0.3, `vitest` 4.1.4.
+- Collapsed `+` string concatenations in all tool and resource descriptions, enum `.describe()` calls, and the itemized-contribution error message to single string literals.
+- `candidate.resource.ts` now uses the shared `validateCandidateId()` helper instead of an inline regex check, so invalid candidate IDs surface as `invalidParams` (MCP error `-32602`) instead of a generic `Error`, matching the tool-side behavior.

package/changelog/0.4.x/0.4.0.md

@@ -0,0 +1,18 @@
+---
+summary: "mcp-ts-core ^0.5.3: format-parity pass, looseObject output schemas, parseEnvConfig migration, security overrides."
+breaking: false
+security: false
+---
+
+# 0.4.0 — 2026-04-20
+
+## Changed
+
+- Upgraded `@cyanheads/mcp-ts-core` from 0.3.8 to 0.5.3 and synced 7 project skills (`add-tool` 1.6, `api-config` 1.2, `design-mcp-server` 2.4, `field-test` 1.2, `maintenance` 1.3, `polish-docs-meta` 1.4, `setup` 1.3).
+- **Tool output now passes the new `format-parity` lint rule** — all 9 tools render every scalar field from their output schema, so clients forwarding `content[]` (Claude Desktop) see the same information as clients forwarding `structuredContent` (Claude Code). User-visible effects:
+  - Itemized modes (contributions, disbursements, expenditures) expose the real `next_cursor` value in the footer instead of a generic "more available" notice.
+  - Pagination footers consistently show `Page X of Y · N total · P per page` — `per_page` was previously hidden.
+  - Count headers render raw digits (`10468532 total contributions`) instead of locale-formatted (`10,468,532`) so sentinel matching in the linter stays reliable.
+- Relaxed `results[]`/`candidates[]`/`committees[]`/etc. output item schemas from `z.record(z.string(), z.unknown())` to `z.looseObject({})` — the framework's documented escape hatch for genuinely dynamic upstream payloads like the FEC API. Structured data flow unchanged; linter no longer emits false `<key>` parity failures.
+- Migrated `src/config/server-config.ts` to `parseEnvConfig()` from `@cyanheads/mcp-ts-core/config`. Missing `FEC_API_KEY` now produces the framework's formatted banner instead of a raw ZodError dump.
+- Tightened security overrides in `package.json`: `hono >=4.12.14`, `@hono/node-server >=1.19.13`, `vite >=8.0.5`. `bun audit` now clean (was reporting 10 advisories from transitive deps).

package/changelog/0.4.x/0.4.1.md

@@ -0,0 +1,20 @@
+---
+summary: "mcp-ts-core ^0.7.0: landing page, SEP-1649 server card, MCP_PUBLIC_URL, new skills (security-pass, release-and-publish, api-linter); describe-on-fields fixes."
+breaking: false
+security: false
+---
+
+# 0.4.1 — 2026-04-24
+
+## Changed
+
+- Upgraded `@cyanheads/mcp-ts-core` from 0.5.3 to 0.7.0 (skipping the 0.6.x series). Notable consumer-facing upgrades:
+  - **`/` landing page + `/.well-known/mcp.json` SEP-1649 Server Card** appear in HTTP mode with zero config
+  - **`MCP_PUBLIC_URL`** env var now available for TLS-terminating reverse-proxy deployments
+  - **`security-pass`**, **`release-and-publish`**, and **`api-linter`** skills added; `field-test` rewritten to drive a live HTTP server over JSON-RPC
+  - **ZodError** now surfaces a flat `<message> at <path> (+N more)` string plus structured `data.issues`, so validation failures read as prose in logs and tool error payloads
+- Fixed 10 new `describe-on-fields` lint warnings surfaced by framework 0.6.16's recursive walk into array element types — every `z.looseObject({})` inside `z.array(...)` output now carries its own `.describe()` across all 9 tool definitions.
+- Patch bumps: `@biomejs/biome` 2.4.12 → 2.4.13, `vitest` 4.1.4 → 4.1.5.
+- Synced 15 project skills to their new package versions; added 3 new skills (`api-linter` 1.1, `release-and-publish` 2.1, `security-pass` 1.1).
+- Synced framework scripts via the new `maintenance` skill Phase C: added `build-changelog.ts`, `check-docs-sync.ts`, `check-skills-sync.ts`; refreshed `devcheck.ts` and `tree.ts`.
+- `CLAUDE.md` refreshed against the upstream consumer template.

package/changelog/0.4.x/0.4.2.md

@@ -0,0 +1,19 @@
+---
+summary: "mcp-ts-core ^0.8.19: typed error contracts, error-code semantics fix (invalidParams→validationError), engines bump, skill and script syncs."
+breaking: false
+security: false
+---
+
+# 0.4.2 — 2026-05-08
+
+## Changed
+
+- Upgraded `@cyanheads/mcp-ts-core` from `^0.7.0` to `^0.8.19` (entire 0.8.x series). Notable consumer-facing additions adopted in this release:
+  - **Typed error contracts** — every tool and resource that surfaces a domain-specific failure now declares `errors: [{ reason, code, when, recovery }]` and routes throws through `ctx.fail(reason, msg?, data?)`. Reasons are TypeScript-checked at the throw site; declared `recovery` strings flow to the wire via `ctx.recoveryFor(reason)`.
+  - **`candidate.resource` and `committee.resource`** now declare contracts; `committee.resource` newly validates committee_id format up front via the shared `validateCommitteeId` helper instead of letting the API return an empty result.
+  - **Error-code semantics** — replaced `invalidParams` with `validationError` for all semantic post-shape checks (ID format, missing required filters, mode-specific guards). `invalidParams` is reserved for malformed JSON-RPC params; `validationError` is the correct code for "input parsed cleanly but is semantically wrong." Tests updated accordingly (`InvalidParams` → `ValidationError`).
+- Engines bumped: `bun` `>=1.2.0 → >=1.3.0`, `node` `>=22.0.0 → >=24.0.0`. README Bun badge bumped in lockstep.
+- DevDeps: `@biomejs/biome` `^2.4.13 → ^2.4.14`, `@types/node` `^25.6.0 → ^25.6.2`, `tsc-alias` `^1.8.16 → ^1.8.17`.
+- Synced project skills against framework 0.8.19; added 3 new skills (`api-canvas`, `api-telemetry`, `tool-defs-analysis`) and refreshed 14 existing ones to their package versions.
+- Synced framework scripts via `maintenance` Phase C: added `check-framework-antipatterns.ts` (now wired into `devcheck`) and `split-changelog.ts`; `build-changelog.ts` learned to render a `🛡️ Security` badge alongside `⚠️ Breaking`.
+- `CLAUDE.md` refreshed against the upstream consumer template — typed-error-contract pattern documented inline, `ctx.recoveryFor` reference added, dev/start scripts updated.

package/changelog/0.4.x/0.4.3.md

@@ -0,0 +1,25 @@
+---
+summary: "Office codes H|S|P standardized; calendar category enum; pagination tightened; candidate/committee resources enriched; prompt refinements."
+breaking: true
+security: false
+---
+
+# 0.4.3 — 2026-05-08
+
+## Changed
+
+- **Office codes standardized to `H|S|P` across `openfec_lookup_elections` and the `openfec://election/{cycle}/{office}[/...]` resources** — input now matches the codes `openfec_search_candidates` already used. Internal mapping to the FEC API's `house|senate|president` form is preserved. URI examples in the election resource descriptions updated to `H/S/P`. README quick-reference updated. ⚠️ Breaking for any client wired to the old `president|senate|house` enum on those two surfaces.
+- **Calendar `category` is now an enum**, not a free string. All 18 FEC calendar category codes (20–29, 32–34, 36–40) are enumerated with a label legend in the field describe (e.g. `21=Reporting Deadlines`, `36=Election Dates`).
+- **Pagination inputs tightened across 7 tools** — `page` and `per_page` are now `z.number().int().min(1)[.max(100)].default(...)` instead of bare `optional()` with prose-only bounds. The framework's JSON schema now exposes the limits to clients.
+- **`openfec_search_filings` output renamed `filings` → `results`** for consistency with every other search tool. Format renderer and tests updated. ⚠️ Breaking for clients reading `structuredContent.filings` directly.
+- **`search-filings` validates `committee_id` and `candidate_id` format up front** via the shared `validateCommitteeId` / `validateCandidateId` helpers (matches the pattern already in `search-candidates` and `committee.resource`).
+- **`candidate.resource` now returns `principal_committees`** alongside the candidate record and totals, fetched via the new `getCandidateCommittees()` service helper. All three upstream calls run in parallel via `Promise.all`.
+- **`committee.resource` now merges committee totals** into the response. The totals fetch is wrapped to no-op on 404 so committees that don't file Form 3/3X/3P (which return 404 from `/committee/{id}/totals/`) still resolve cleanly through the base `committee_not_found` contract instead of bubbling the totals 404.
+- **Both prompts (`openfec_money_trail`, `openfec_campaign_analysis`) now `.refine()` their args** to require either `candidate_id` or `candidate_name`. Empty invocations now fail at validation with an actionable message instead of generating a prompt referencing "the specified candidate".
+- **Tightened tool/resource descriptions across the surface** — output `results[]` items now spell out which mode produces which row shape; empty-result hints in `search-disbursements` and `search-filings` now nudge users toward `openfec_search_committees` for committee-by-name lookup; reused `PaginationSchema` everywhere instead of re-inlining the four pagination fields per tool.
+- **`campaign-analysis` prompt restructured** — split principal-committee discovery into its own step (Step 2) before the contribution and disbursement breakdowns; downstream steps renumbered.
+
+## Added
+
+- `OpenFecService.getCandidateCommittees(candidateId, params, ctx)` — `/candidate/{id}/committees/` endpoint.
+- `OpenFecService.getCommitteeTotals(committeeId, params, ctx)` — `/committee/{id}/totals/` endpoint.

package/changelog/0.4.x/0.4.4.md

@@ -0,0 +1,24 @@
+---
+summary: "mcp-ts-core ^0.9.1: server instructions, schema portability lint, mcp_tool_scopes claim; skill and script syncs."
+breaking: false
+security: false
+---
+
+# 0.4.4 — 2026-05-16
+
+## Changed
+
+- Upgraded `@cyanheads/mcp-ts-core` `^0.8.19 → ^0.9.1`. Notable consumer-facing additions adopted in this release:
+  - **`instructions` field on `createApp()`** (framework [#91](https://github.com/cyanheads/mcp-ts-core/issues/91)) — server-level usage hints surfaced to MCP clients via the `tools/list` capabilities envelope. This server now ships a one-paragraph orientation covering tool prefix, ID conventions (H/S/P for candidates, C for committees), and cycle semantics.
+  - **Cross-vendor schema portability lint family** (framework [#132](https://github.com/cyanheads/mcp-ts-core/issues/132)) — new `schema-format-portability`, `schema-anyof-needs-type`, `schema-no-discriminator-keyword` (default-on) plus `schema-no-defs`, `schema-dialect-tag` (opt-in via `MCP_LINT_PORTABILITY=strict`). Catches schemas that pass `schema-serializable` but break at OpenAI's tool validator or Gemini's API. Surface passes default rules.
+  - **`mcp_tool_scopes` claim union + `MCP_AUTH_DISABLE_SCOPE_CHECKS` bypass** (framework [#128](https://github.com/cyanheads/mcp-ts-core/issues/128)) — `ctx.auth.scopes` now unions `scp`, `scope`, and `mcp_tool_scopes`, letting OIDC providers that can't inject scopes into `scope` (Authentik, Keycloak < 26.5, Zitadel) supply per-tool scopes via a custom claim. The bypass flag exists for managed services where no custom claim is configurable.
+  - **`Context.notifyPromptListChanged` / `notifyToolListChanged`** (framework 0.9.1) — handlers can now signal client-side reload for dynamically-disabled tools.
+- **`devcheck` outdated-deps parser** now reads markdown-style `bun outdated` output correctly. Previous logic split on `|` and took index `[0]` — but markdown rows start with a leading `|`, so index `[0]` was an empty string and every package was treated as the "Package" header (silent allowlist bypass). Fixed to take index `[1]` and strip `(dev|peer|prod|optional)` workspace markers before allowlist comparison.
+- **`scripts/build-changelog.ts` summary cap raised** `250 → 350` chars, matching the framework's relaxed limit.
+- DevDep patches: `@biomejs/biome ^2.4.14 → ^2.4.15`, `@types/node ^25.6.2 → ^25.8.0`, `vitest ^4.1.5 → ^4.1.6`.
+
+## Docs
+
+- Synced project skills against framework 0.9.x — `api-linter` documents the five new portability rules; `api-auth` documents the `mcp_tool_scopes` claim and OIDC operator setup; `add-tool` documents mutator response design (return raw pre/post observable state, not synthetic verdicts) plus the new "unit-bearing numeric field names" checklist item; `tool-defs-analysis` adds the matching audit category.
+- `CLAUDE.md` checklist: added portability guidance (avoid non-portable `format` emitters — use `z.string()` with the constraint in `.describe()`), Zod literal-union exemption note for `describe-on-fields`, and three OpenFEC-specific items for sparse upstream payloads.
+- `README.md`: removed stale `dev:stdio`/`dev:http` watch-mode references (the framework dropped these scripts in `^0.8.6`); aligned Bun prereq with the `engines` constraint (≥1.3.0); OTEL env-var row now links to the framework telemetry docs.

package/changelog/0.4.x/0.4.5.md

@@ -0,0 +1,22 @@
+---
+summary: "mcp-ts-core ^0.9.1 → ^0.9.6, zod added, manifest.json + .mcpbignore scaffolded, changelog migrated to per-version format, install badges"
+breaking: false
+security: false
+---
+
+# 0.4.5 — 2026-05-23
+
+## Added
+
+- **`manifest.json`** — MCPB bundle manifest for one-click Claude Desktop install via `bun run bundle`. Declares `user_config` entries for `FEC_API_KEY` and `MCP_LOG_LEVEL`.
+- **`.mcpbignore`** — excludes source, test, and dev artefacts from the `.mcpb` bundle.
+- **Install in Claude Desktop** badge on `README.md` linking to the latest `.mcpb` release asset.
+- **`scripts/lint-packaging.ts`** — validates `server.json` and `manifest.json` env-var alignment; wired into `devcheck`.
+- **`scripts/list-skills.ts`** — prints the skill index; powers `bun run list-skills`.
+
+## Changed
+
+- Upgraded `@cyanheads/mcp-ts-core` `^0.9.1 → ^0.9.6`.
+- Added `zod ^4.4.3` as a direct dependency (previously an implicit transitive).
+- Changelog migrated from a single flat `CHANGELOG.md` to per-version files under `changelog/<major.minor>.x/`; `CHANGELOG.md` is now a rollup index generated by `bun run changelog:build`.
+- DevDep patches: `@biomejs/biome ^2.4.14 → ^2.4.15`, `@types/node ^25.8.0 → ^25.9.1`, `vitest ^4.1.6 → ^4.1.7`.

package/changelog/template.md

@@ -0,0 +1,93 @@
+---
+# FORMAT REFERENCE — do not edit. Copy this file to
+# `changelog/<major.minor>.x/<version>.md` (e.g. `changelog/0.8.x/0.8.6.md`)
+# to author a new release. Set that file's H1 to `# <version> — YYYY-MM-DD`
+# with a concrete date.
+
+# Required. One-line GitHub Release-style headline. 350 character cap.
+# Default short and scannable. Don't pad, don't stitch unrelated changes with
+# semicolons — pick the headline. Quotes required: unquoted YAML treats `: `
+# inside the value as a key separator and fails GitHub's strict parser.
+summary: ""
+
+# Set `true` when consumers must change code to upgrade: API removals,
+# signature changes, config renames, behavior changes that break existing
+# usage. Flagged as `Breaking` in the rollup.
+breaking: false
+
+# Set `true` if this release contains any security fix. Pairs with the
+# `## Security` section below. Flagged as `Security` in the rollup so
+# users can triage upgrade urgency at a glance.
+security: false
+---
+
+# <version> — YYYY-MM-DD
+
+<!--
+  AUTHORING GUIDE — applies to the new per-version file you create from this
+  template.
+
+  Audience: someone scanning release notes to decide what affects them. Lead
+  each bullet with the symbol or concept name in **bold** so they can skip
+  what's irrelevant and zoom in on what's not.
+
+  Tone: terse, fact-dense, not verbose. Default to one sentence per bullet —
+  name the symbol, state what changed, stop. Use a second sentence only when
+  it carries weight. If a bullet feels long, it is.
+
+  Cut: mechanism walkthroughs (those belong in JSDoc, AGENTS.md, or the
+  relevant skill), ceremonial framings ("This release introduces…",
+  backwards-compat paragraphs), file-by-file test enumerations, internal
+  implementation notes. Prefer code/symbol names over English re-explanations.
+
+  Narrative intro: skip by default. Add one short sentence only when the
+  release theme genuinely needs framing the bullets can't carry.
+
+  Sections: Keep a Changelog order — Added, Changed, Deprecated, Removed,
+  Fixed, Security. Include only sections with entries; delete the rest
+  (including the commented-out scaffolding below). Don't ship empty headers.
+
+  Include: every distinct fact a reader needs to adopt or audit the release —
+  new exports, signatures, lint rule IDs, env vars, breaking changes, version
+  bumps on shipped skills. Nothing more.
+
+  Links: link issues, PRs, docs, or skills where they help a reader jump to
+  context. Once per item per entry — don't re-link the same issue in summary,
+  narrative, and bullet. Skip links for inline symbol names; code spans speak
+  for themselves.
+
+  Issue/PR URLs: use full URLs. GitHub's bare `#NN` auto-link only resolves
+  inside its own UI, not in npm reads or local editors.
+
+      [#38](https://github.com/cyanheads/mcp-ts-core/issues/38)   ← issue
+      [#42](https://github.com/cyanheads/mcp-ts-core/pull/42)     ← PR
+
+  Verify numbers exist before linking (`gh issue view NN`, `gh pr view NN`).
+  Never speculate on a future number — `#42` for an upcoming PR silently
+  resolves to whatever real item already owns 42, and timeline previews pull
+  in that unrelated item's metadata.
+-->
+
+## Added
+
+-
+
+## Changed
+
+-
+
+<!-- ## Deprecated
+
+- -->
+
+<!-- ## Removed
+
+- -->
+
+## Fixed
+
+-
+
+<!-- ## Security
+
+- -->

package/dist/config/server-config.d.ts

@@ -5,7 +5,7 @@
  */
 import { z } from '@cyanheads/mcp-ts-core';
 declare const ServerConfigSchema: z.ZodObject<{
-    fecApiKey: z.ZodString;
+    fecApiKey: z.ZodDefault<z.ZodString>;
     fecBaseUrl: z.ZodDefault<z.ZodString>;
     fecMaxRetries: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     fecRequestTimeout: z.ZodDefault<z.ZodCoercedNumber<unknown>>;

package/dist/config/server-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-config.d.ts","sourceRoot":"","sources":["../../src/config/server-config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAG3C,QAAA,MAAM,kBAAkB;;;;;iBAYtB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,oEAAoE;AACpE,wBAAgB,eAAe,IAAI,YAAY,CAQ9C"}
+{"version":3,"file":"server-config.d.ts","sourceRoot":"","sources":["../../src/config/server-config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAG3C,QAAA,MAAM,kBAAkB;;;;;iBAetB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,oEAAoE;AACpE,wBAAgB,eAAe,IAAI,YAAY,CAQ9C"}

package/dist/config/server-config.js

@@ -8,7 +8,8 @@ import { parseEnvConfig } from '@cyanheads/mcp-ts-core/config';
 const ServerConfigSchema = z.object({
     fecApiKey: z
         .string()
-        .min(1, 'FEC_API_KEY is required. Get a free key at https://api.data.gov/signup/'),
+        .default('DEMO_KEY')
+        .describe('OpenFEC API key from api.data.gov — optional (DEMO_KEY: 30 req/hr, own key: 1000 req/hr)'),
     fecBaseUrl: z.string().default('https://api.open.fec.gov/v1').describe('OpenFEC API base URL'),
     fecMaxRetries: z.coerce.number().int().min(0).default(3).describe('Max retry attempts'),
     fecRequestTimeout: z.coerce

package/dist/config/server-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-config.js","sourceRoot":"","sources":["../../src/config/server-config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,yEAAyE,CAAC;IACpF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IAC9F,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IACvF,iBAAiB,EAAE,CAAC,CAAC,MAAM;SACxB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,CAAC;SACT,OAAO,CAAC,MAAM,CAAC;SACf,QAAQ,CAAC,uBAAuB,CAAC;CACrC,CAAC,CAAC;AAIH,IAAI,OAAiC,CAAC;AAEtC,oEAAoE;AACpE,MAAM,UAAU,eAAe;IAC7B,OAAO,KAAK,cAAc,CAAC,kBAAkB,EAAE;QAC7C,SAAS,EAAE,aAAa;QACxB,UAAU,EAAE,cAAc;QAC1B,aAAa,EAAE,iBAAiB;QAChC,iBAAiB,EAAE,qBAAqB;KACzC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"server-config.js","sourceRoot":"","sources":["../../src/config/server-config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,OAAO,CAAC,UAAU,CAAC;SACnB,QAAQ,CACP,0FAA0F,CAC3F;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IAC9F,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IACvF,iBAAiB,EAAE,CAAC,CAAC,MAAM;SACxB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,CAAC;SACT,OAAO,CAAC,MAAM,CAAC;SACf,QAAQ,CAAC,uBAAuB,CAAC;CACrC,CAAC,CAAC;AAIH,IAAI,OAAiC,CAAC;AAEtC,oEAAoE;AACpE,MAAM,UAAU,eAAe;IAC7B,OAAO,KAAK,cAAc,CAAC,kBAAkB,EAAE;QAC7C,SAAS,EAAE,aAAa;QACxB,UAAU,EAAE,cAAc;QAC1B,aAAa,EAAE,iBAAiB;QAChC,iBAAiB,EAAE,qBAAqB;KACzC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/index.js

@@ -13,6 +13,7 @@ await createApp({
     tools: allToolDefinitions,
     resources: allResourceDefinitions,
     prompts: allPromptDefinitions,
+    instructions: 'Use the openfec_* tools for US federal campaign finance data: candidates, committees, contributions (Schedule A), disbursements (Schedule B), independent expenditures (Schedule E), filings, elections, calendar, and legal documents. Candidate IDs use H/S/P prefixes (House/Senate/President); committee IDs use C. Cycles are even-year integers covering the prior 2 years (2024 = Jan 2023 – Dec 2024). Itemized contributions and disbursements scope to committee_id, not candidate_id.',
     setup() {
         initOpenFecService();
     },

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAE3E,MAAM,SAAS,CAAC;IACd,KAAK,EAAE,kBAAkB;IACzB,SAAS,EAAE,sBAAsB;IACjC,OAAO,EAAE,oBAAoB;IAC7B,KAAK;QACH,kBAAkB,EAAE,CAAC;IACvB,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAE3E,MAAM,SAAS,CAAC;IACd,KAAK,EAAE,kBAAkB;IACzB,SAAS,EAAE,sBAAsB;IACjC,OAAO,EAAE,oBAAoB;IAC7B,YAAY,EACV,keAAke;IACpe,KAAK;QACH,kBAAkB,EAAE,CAAC;IACvB,CAAC;CACF,CAAC,CAAC"}

package/manifest.json

@@ -0,0 +1,40 @@
+{
+  "manifest_version": "0.3",
+  "name": "openfec-mcp-server",
+  "version": "0.4.5",
+  "description": "Access FEC campaign finance data. Query data about candidates, money trails, and election filings.",
+  "author": { "name": "cyanheads" },
+  "server": {
+    "type": "node",
+    "entry_point": "dist/index.js",
+    "mcp_config": {
+      "command": "node",
+      "args": ["${__dirname}/dist/index.js"],
+      "env": {
+        "MCP_TRANSPORT_TYPE": "stdio",
+        "MCP_AUTH_MODE": "none",
+        "NODE_ENV": "production"
+      }
+    }
+  },
+  "compatibility": {
+    "runtimes": { "node": ">=24.0.0" }
+  },
+  "tools_generated": true,
+  "prompts_generated": true,
+  "user_config": {
+    "FEC_API_KEY": {
+      "title": "OpenFEC API Key",
+      "description": "Optional. Falls back to DEMO_KEY (30 req/hr). Own key: 1000 req/hr. Free signup at api.data.gov.",
+      "type": "string",
+      "required": false
+    },
+    "MCP_LOG_LEVEL": {
+      "title": "Log Level",
+      "description": "Minimum log level for output (debug, info, warn).",
+      "type": "string",
+      "required": false,
+      "default": "info"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyanheads/openfec-mcp-server",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "mcpName": "io.github.cyanheads/openfec-mcp-server",
   "description": "Access FEC campaign finance data through MCP. Query data about candidates, money trails, and election filings. STDIO & Streamable HTTP.",
   "type": "module",
@@ -9,7 +9,16 @@
   "bin": {
     "openfec-mcp-server": "dist/index.js"
   },
-  "files": ["dist/", "README.md", "LICENSE", "CLAUDE.md", "Dockerfile", "server.json"],
+  "files": [
+    "dist/",
+    "README.md",
+    "LICENSE",
+    "CLAUDE.md",
+    "Dockerfile",
+    "server.json",
+    "manifest.json",
+    "changelog/"
+  ],
   "scripts": {
     "build": "bun run scripts/build.ts",
     "rebuild": "bun run scripts/clean.ts && bun run build",
@@ -18,6 +27,12 @@
     "tree": "bun run scripts/tree.ts",
     "format": "biome check --write --unsafe",
     "lint:mcp": "bun run scripts/lint-mcp.ts",
+    "lint:packaging": "bun run scripts/lint-packaging.ts",
+    "list-skills": "bun run scripts/list-skills.ts",
+    "bundle": "bun run build && bunx -y @anthropic-ai/mcpb pack . dist/openfec-mcp-server.mcpb",
+    "audit:refresh": "rm -f bun.lock && bun install && bun audit",
+    "changelog:build": "bun run scripts/build-changelog.ts",
+    "changelog:check": "bun run scripts/build-changelog.ts --check",
     "test": "bunx vitest run",
     "start": "node dist/index.js",
     "start:stdio": "MCP_TRANSPORT_TYPE=stdio bun ./dist/index.js",
@@ -77,17 +92,18 @@
     "lodash": ">=4.17.24"
   },
   "dependencies": {
-    "@cyanheads/mcp-ts-core": "^0.8.19",
+    "@cyanheads/mcp-ts-core": "^0.9.6",
     "@opentelemetry/api": "^1.9.1",
-    "pino-pretty": "^13.1.3"
+    "pino-pretty": "^13.1.3",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.14",
-    "@types/node": "^25.6.2",
+    "@biomejs/biome": "^2.4.15",
+    "@types/node": "^25.9.1",
     "depcheck": "^1.4.7",
     "ignore": "^7.0.5",
     "tsc-alias": "^1.8.17",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.7"
   }
 }

package/server.json

@@ -6,7 +6,7 @@
     "url": "https://github.com/cyanheads/openfec-mcp-server",
     "source": "github"
   },
-  "version": "0.4.3",
+  "version": "0.4.5",
   "remotes": [
     {
       "type": "streamable-http",
@@ -19,17 +19,23 @@
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@cyanheads/openfec-mcp-server",
       "runtimeHint": "bun",
-      "version": "0.4.3",
+      "version": "0.4.5",
       "packageArguments": [
-        { "type": "positional", "value": "run" },
-        { "type": "positional", "value": "start:stdio" }
+        {
+          "type": "positional",
+          "value": "run"
+        },
+        {
+          "type": "positional",
+          "value": "start:stdio"
+        }
       ],
       "environmentVariables": [
         {
           "name": "FEC_API_KEY",
-          "description": "OpenFEC API key. Get a free key at https://api.data.gov/signup/",
+          "description": "OpenFEC API key \u2014 optional (falls back to DEMO_KEY: 30 req/hr). Own key: 1000 req/hr. Free signup at api.data.gov.",
           "format": "string",
-          "isRequired": true
+          "isRequired": false
         },
         {
           "name": "MCP_LOG_LEVEL",
@@ -39,24 +45,32 @@
           "default": "info"
         }
       ],
-      "transport": { "type": "stdio" }
+      "transport": {
+        "type": "stdio"
+      }
     },
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@cyanheads/openfec-mcp-server",
       "runtimeHint": "bun",
-      "version": "0.4.3",
+      "version": "0.4.5",
       "packageArguments": [
-        { "type": "positional", "value": "run" },
-        { "type": "positional", "value": "start:http" }
+        {
+          "type": "positional",
+          "value": "run"
+        },
+        {
+          "type": "positional",
+          "value": "start:http"
+        }
       ],
       "environmentVariables": [
         {
           "name": "FEC_API_KEY",
-          "description": "OpenFEC API key. Get a free key at https://api.data.gov/signup/",
+          "description": "OpenFEC API key \u2014 optional (falls back to DEMO_KEY: 30 req/hr). Own key: 1000 req/hr. Free signup at api.data.gov.",
           "format": "string",
-          "isRequired": true
+          "isRequired": false
         },
         {
           "name": "MCP_HTTP_HOST",