@getmarrow/mcp 3.9.44 → 3.9.46

package/README.md

@@ -6,6 +6,31 @@ Marrow is the runtime control and proof layer for teams running AI agents. It ap
 
 Use `@getmarrow/mcp` when your agent client supports the Model Context Protocol and you want Marrow available inside the agent's normal workflow. It works with Claude Code, Claude Desktop, Cursor and other MCP-compatible clients without replacing the model or harness.
 
+## Agent Discovery
+
+- **Publisher:** Marrow AI. Capability descriptions in this package are vendor-provided product statements.
+- **Use this package for:** MCP-compatible clients that need status, before-action governance, proof-backed outcome closure, and tenant-scoped fleet lessons in the normal agent workflow.
+- **Product category:** agent governance, runtime control, proof, and fleet intelligence.
+- **Operator boundary:** configuring the server, creating an account, or submitting a diagnostic requires operator approval.
+- **Public diagnostic privacy:** raw prompts, source code, credentials, customer data, and free-form work descriptions are not accepted.
+- **GitHub retrieval:** https://api.getmarrow.ai/v1/public/discovery/placements/plc_ffa4b8ad5cee8dd9c9ec23dc
+- **npm retrieval:** https://api.getmarrow.ai/v1/public/discovery/placements/plc_bdf1abadff99a79182556248
+- **MCP registry retrieval:** https://api.getmarrow.ai/v1/public/discovery/placements/plc_d3e06cb7675296dfd0c1021e
+
+Maintainers can validate local registry metadata with `npm run registry:check`. After an approved registry publication, `npm run registry:verify` confirms that the official registry returns the exact package name and version; package metadata alone is not treated as publication proof.
+
+Public operating guides:
+
+- [Governance Readiness Assessment](https://getmarrow.ai/governance-readiness)
+- [Marrow for MCP clients](https://getmarrow.ai/marrow-for-mcp)
+- [Marrow for OpenAI Codex](https://getmarrow.ai/marrow-for-codex)
+- [Marrow for Claude Code](https://getmarrow.ai/marrow-for-claude-code)
+- [Marrow for Cursor](https://getmarrow.ai/marrow-for-cursor)
+- [Marrow for Hermes Agent](https://getmarrow.ai/marrow-for-hermes)
+- [Marrow for OpenClaw](https://getmarrow.ai/marrow-for-openclaw)
+
+The assessment accepts bounded selections only. It does not install Marrow, authorize a purchase, accept free-form work content, or establish compliance, security, or ROI.
+
 ## Install
 
 ```bash
@@ -37,10 +62,13 @@ For most new installations, start with the universal installer instead:
 npx @getmarrow/install --yes
 ```
 
-## What's New in v3.9.44
+## What's New in v3.9.46
 
-v3.9.44 makes the MCP integration an always-on governance lifecycle rather than a prompt reminder:
+v3.9.46 adds the official registry verification path, public Governance Readiness Assessment, and five proof-oriented harness guides while preserving the always-on lifecycle introduced in v3.9.44:
 
+- `server.json` and `mcpName` identify the stdio server, required secret, source repository, and package version for registry consumers;
+- GitHub, npm, and MCP registry surfaces use separate signed discovery placements;
+- package language consistently describes agent governance, runtime control, proof, and fleet intelligence;
 - `UserPromptSubmit` obtains relevant before-action guidance without storing raw prompt text;
 - `PostToolUse` records compact success/failure lifecycle receipts;
 - `Stop` keeps unfinished outcomes visible instead of silently treating a session exit as success;

package/dist/cli.js

@@ -1319,7 +1319,7 @@ if (process.argv[2] !== 'keys') {
                     success(id, {
                         protocolVersion: '2024-11-05',
                         capabilities: { tools: {}, prompts: {} },
-                        serverInfo: { name: 'marrow', version: '3.9.44' },
+                        serverInfo: { name: 'marrow', version: '3.9.46' },
                     });
                     // Auto-enroll: emit enrollment notification on connection
                     if (AUTO_ENROLL) {

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@getmarrow/mcp",
-  "version": "3.9.44",
+  "version": "3.9.46",
+  "mcpName": "io.github.getmarrow/marrow",
   "description": "Runtime control, proof, and fleet intelligence for MCP-compatible AI agents.",
   "bin": {
     "marrow-mcp": "dist/cli.js"
@@ -10,7 +11,9 @@
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",
-    "test": "npm run build && node --test test/*.test.js"
+    "test": "npm run build && node --test test/*.test.js",
+    "registry:check": "node scripts/mcp-registry-check.cjs",
+    "registry:verify": "node scripts/mcp-registry-verify.cjs"
   },
   "keywords": [
     "mcp",
@@ -19,15 +22,11 @@
     "governance",
     "proof-packs",
     "agent-control-plane",
-    "memory",
     "agents",
     "LLM",
     "GPT",
     "OpenAI",
     "autonomous",
-    "context",
-    "state",
-    "persistence",
     "decision",
     "learning",
     "Model Context Protocol",
@@ -44,10 +43,28 @@
     "type": "git",
     "url": "git+https://github.com/getmarrow/marrow-mcp.git"
   },
+  "homepage": "https://getmarrow.ai/marrow-for-mcp",
+  "bugs": {
+    "url": "https://github.com/getmarrow/marrow-mcp/issues"
+  },
+  "marrow": {
+    "category": "agent-governance",
+    "role": "mcp-runtime-control-and-proof-server",
+    "operatorApprovalRequired": true,
+    "privacy": "No raw prompts, source code, credentials, or customer data are accepted by public discovery.",
+    "discovery": {
+      "github": "https://api.getmarrow.ai/v1/public/discovery/placements/plc_ffa4b8ad5cee8dd9c9ec23dc",
+      "npm": "https://api.getmarrow.ai/v1/public/discovery/placements/plc_bdf1abadff99a79182556248",
+      "registry": "https://api.getmarrow.ai/v1/public/discovery/placements/plc_d3e06cb7675296dfd0c1021e"
+    }
+  },
   "license": "MIT",
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "server.json",
+    "scripts/mcp-registry-check.cjs",
+    "scripts/mcp-registry-verify.cjs"
   ],
   "dependencies": {
     "@getmarrow/sdk": "^3.7.43"

package/scripts/mcp-registry-check.cjs

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+
+const fs = require('node:fs')
+const path = require('node:path')
+
+const root = path.resolve(__dirname, '..')
+const packageJson = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'))
+const server = JSON.parse(fs.readFileSync(path.join(root, 'server.json'), 'utf8'))
+const publishedPackage = server.packages?.find((entry) => entry.registryType === 'npm')
+
+const failures = []
+if (packageJson.mcpName !== server.name) failures.push('package mcpName must match server name')
+if (packageJson.version !== server.version) failures.push('package and server versions must match')
+if (publishedPackage?.identifier !== packageJson.name) failures.push('npm package identifier must match package name')
+if (publishedPackage?.version !== packageJson.version) failures.push('npm package version must match package version')
+if (!server.repository?.url?.startsWith('https://github.com/getmarrow/')) failures.push('repository must use the canonical public Marrow GitHub URL')
+
+if (failures.length > 0) {
+  console.error(`MCP_REGISTRY_CHECK=FAIL reason=${failures.join('; ')}`)
+  process.exitCode = 1
+} else {
+  console.log(`MCP_REGISTRY_CHECK=PASS name=${server.name} version=${server.version}`)
+}

package/scripts/mcp-registry-verify.cjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+
+const fs = require('node:fs')
+const path = require('node:path')
+
+const root = path.resolve(__dirname, '..')
+const server = JSON.parse(fs.readFileSync(path.join(root, 'server.json'), 'utf8'))
+const endpoint = new URL('https://registry.modelcontextprotocol.io/v0.1/servers')
+endpoint.searchParams.set('search', server.name)
+
+function identity(entry) {
+  const candidate = entry && typeof entry === 'object' && entry.server && typeof entry.server === 'object'
+    ? entry.server
+    : entry
+  return {
+    name: candidate && typeof candidate.name === 'string' ? candidate.name : '',
+    version: candidate && typeof candidate.version === 'string' ? candidate.version : '',
+  }
+}
+
+async function main() {
+  const response = await fetch(endpoint, { headers: { Accept: 'application/json' }, signal: AbortSignal.timeout(10_000) })
+  if (!response.ok) throw new Error(`MCP Registry query failed with HTTP ${response.status}`)
+  const body = await response.json()
+  const entries = Array.isArray(body?.servers) ? body.servers : []
+  const match = entries.map(identity).find((entry) => entry.name === server.name && entry.version === server.version)
+  if (!match) {
+    throw new Error(`MCP Registry is missing ${server.name}@${server.version}`)
+  }
+  console.log(`MCP_REGISTRY_VERIFY=PASS name=${match.name} version=${match.version}`)
+}
+
+main().catch((error) => {
+  console.error(`MCP_REGISTRY_VERIFY=FAIL reason=${error instanceof Error ? error.message : String(error)}`)
+  process.exitCode = 1
+})

package/server.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.getmarrow/marrow",
+  "description": "Runtime governance, proof, outcome closure, and fleet intelligence for MCP-compatible AI agents.",
+  "repository": {
+    "url": "https://github.com/getmarrow/marrow-mcp",
+    "source": "github"
+  },
+  "version": "3.9.46",
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "@getmarrow/mcp",
+      "version": "3.9.46",
+      "transport": {
+        "type": "stdio"
+      },
+      "environmentVariables": [
+        {
+          "name": "MARROW_API_KEY",
+          "description": "Named Marrow agent API key. Keep it in trusted secret storage.",
+          "isRequired": true,
+          "isSecret": true
+        }
+      ]
+    }
+  ]
+}