@getmarrow/mcp 3.9.45 → 3.9.46

package/README.md

@@ -17,6 +17,20 @@ Use `@getmarrow/mcp` when your agent client supports the Model Context Protocol
 - **npm retrieval:** https://api.getmarrow.ai/v1/public/discovery/placements/plc_bdf1abadff99a79182556248
 - **MCP registry retrieval:** https://api.getmarrow.ai/v1/public/discovery/placements/plc_d3e06cb7675296dfd0c1021e
 
+Maintainers can validate local registry metadata with `npm run registry:check`. After an approved registry publication, `npm run registry:verify` confirms that the official registry returns the exact package name and version; package metadata alone is not treated as publication proof.
+
+Public operating guides:
+
+- [Governance Readiness Assessment](https://getmarrow.ai/governance-readiness)
+- [Marrow for MCP clients](https://getmarrow.ai/marrow-for-mcp)
+- [Marrow for OpenAI Codex](https://getmarrow.ai/marrow-for-codex)
+- [Marrow for Claude Code](https://getmarrow.ai/marrow-for-claude-code)
+- [Marrow for Cursor](https://getmarrow.ai/marrow-for-cursor)
+- [Marrow for Hermes Agent](https://getmarrow.ai/marrow-for-hermes)
+- [Marrow for OpenClaw](https://getmarrow.ai/marrow-for-openclaw)
+
+The assessment accepts bounded selections only. It does not install Marrow, authorize a purchase, accept free-form work content, or establish compliance, security, or ROI.
+
 ## Install
 
 ```bash
@@ -48,9 +62,9 @@ For most new installations, start with the universal installer instead:
 npx @getmarrow/install --yes
 ```
 
-## What's New in v3.9.45
+## What's New in v3.9.46
 
-v3.9.45 adds official MCP registry metadata and a consistent distribution contract while preserving the always-on lifecycle introduced in v3.9.44:
+v3.9.46 adds the official registry verification path, public Governance Readiness Assessment, and five proof-oriented harness guides while preserving the always-on lifecycle introduced in v3.9.44:
 
 - `server.json` and `mcpName` identify the stdio server, required secret, source repository, and package version for registry consumers;
 - GitHub, npm, and MCP registry surfaces use separate signed discovery placements;

package/dist/cli.js

@@ -1319,7 +1319,7 @@ if (process.argv[2] !== 'keys') {
                     success(id, {
                         protocolVersion: '2024-11-05',
                         capabilities: { tools: {}, prompts: {} },
-                        serverInfo: { name: 'marrow', version: '3.9.45' },
+                        serverInfo: { name: 'marrow', version: '3.9.46' },
                     });
                     // Auto-enroll: emit enrollment notification on connection
                     if (AUTO_ENROLL) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmarrow/mcp",
-  "version": "3.9.45",
+  "version": "3.9.46",
   "mcpName": "io.github.getmarrow/marrow",
   "description": "Runtime control, proof, and fleet intelligence for MCP-compatible AI agents.",
   "bin": {
@@ -11,7 +11,9 @@
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",
-    "test": "npm run build && node --test test/*.test.js"
+    "test": "npm run build && node --test test/*.test.js",
+    "registry:check": "node scripts/mcp-registry-check.cjs",
+    "registry:verify": "node scripts/mcp-registry-verify.cjs"
   },
   "keywords": [
     "mcp",
@@ -60,7 +62,9 @@
   "files": [
     "dist",
     "README.md",
-    "server.json"
+    "server.json",
+    "scripts/mcp-registry-check.cjs",
+    "scripts/mcp-registry-verify.cjs"
   ],
   "dependencies": {
     "@getmarrow/sdk": "^3.7.43"

package/scripts/mcp-registry-check.cjs

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+
+const fs = require('node:fs')
+const path = require('node:path')
+
+const root = path.resolve(__dirname, '..')
+const packageJson = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'))
+const server = JSON.parse(fs.readFileSync(path.join(root, 'server.json'), 'utf8'))
+const publishedPackage = server.packages?.find((entry) => entry.registryType === 'npm')
+
+const failures = []
+if (packageJson.mcpName !== server.name) failures.push('package mcpName must match server name')
+if (packageJson.version !== server.version) failures.push('package and server versions must match')
+if (publishedPackage?.identifier !== packageJson.name) failures.push('npm package identifier must match package name')
+if (publishedPackage?.version !== packageJson.version) failures.push('npm package version must match package version')
+if (!server.repository?.url?.startsWith('https://github.com/getmarrow/')) failures.push('repository must use the canonical public Marrow GitHub URL')
+
+if (failures.length > 0) {
+  console.error(`MCP_REGISTRY_CHECK=FAIL reason=${failures.join('; ')}`)
+  process.exitCode = 1
+} else {
+  console.log(`MCP_REGISTRY_CHECK=PASS name=${server.name} version=${server.version}`)
+}

package/scripts/mcp-registry-verify.cjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+
+const fs = require('node:fs')
+const path = require('node:path')
+
+const root = path.resolve(__dirname, '..')
+const server = JSON.parse(fs.readFileSync(path.join(root, 'server.json'), 'utf8'))
+const endpoint = new URL('https://registry.modelcontextprotocol.io/v0.1/servers')
+endpoint.searchParams.set('search', server.name)
+
+function identity(entry) {
+  const candidate = entry && typeof entry === 'object' && entry.server && typeof entry.server === 'object'
+    ? entry.server
+    : entry
+  return {
+    name: candidate && typeof candidate.name === 'string' ? candidate.name : '',
+    version: candidate && typeof candidate.version === 'string' ? candidate.version : '',
+  }
+}
+
+async function main() {
+  const response = await fetch(endpoint, { headers: { Accept: 'application/json' }, signal: AbortSignal.timeout(10_000) })
+  if (!response.ok) throw new Error(`MCP Registry query failed with HTTP ${response.status}`)
+  const body = await response.json()
+  const entries = Array.isArray(body?.servers) ? body.servers : []
+  const match = entries.map(identity).find((entry) => entry.name === server.name && entry.version === server.version)
+  if (!match) {
+    throw new Error(`MCP Registry is missing ${server.name}@${server.version}`)
+  }
+  console.log(`MCP_REGISTRY_VERIFY=PASS name=${match.name} version=${match.version}`)
+}
+
+main().catch((error) => {
+  console.error(`MCP_REGISTRY_VERIFY=FAIL reason=${error instanceof Error ? error.message : String(error)}`)
+  process.exitCode = 1
+})

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/getmarrow/marrow-mcp",
     "source": "github"
   },
-  "version": "3.9.45",
+  "version": "3.9.46",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@getmarrow/mcp",
-      "version": "3.9.45",
+      "version": "3.9.46",
       "transport": {
         "type": "stdio"
       },