@gloriginmind/mcp 0.1.1 → 0.1.3

package/README.md

@@ -4,33 +4,55 @@ MCP server for OriginMind dual-auth skill routes. Auth is the same Bootstrap OAu
 
 ## Prerequisites
 
-Run Bootstrap OAuth once on the machine:
-
 ```powershell
 . ./skills/create/scripts/setup-oauth.ps1
 ```
 
-```bash
-source ./skills/create/scripts/setup-oauth.sh
+Key lands in `~/.originmind/.env`. Do **not** paste it into `mcp.json`.
+
+## Cursor — preferred (HTTP URL)
+
+Run the HTTP server once (separate terminal / service):
+
+```powershell
+npx -y -p @gloriginmind/mcp originmind-mcp-http
+# or local: node path/to/skills/mcp/dist/http.js
 ```
 
-Key is stored in `~/.originmind/.env`. Do **not** paste the key into `mcp.json`.
+Defaults: `http://127.0.0.1:3920/mcp` (`ORIGINMIND_MCP_PORT`, `ORIGINMIND_MCP_HOST`).
 
-## Cursor (`mcp.json`)
+Cursor `mcp.json`:
 
 ```json
 {
   "mcpServers": {
     "originmind": {
-      "command": "npx",
-      "args": ["-y", "@gloriginmind/mcp"],
-      "env": {}
+      "url": "http://127.0.0.1:3920/mcp"
     }
   }
 }
 ```
 
-Local checkout (this monorepo):
+The HTTP process reads `ORIGINMIND_API_KEY` from the machine env / `~/.originmind/.env`. Optional override via headers:
+
+```json
+{
+  "mcpServers": {
+    "originmind": {
+      "url": "http://127.0.0.1:3920/mcp",
+      "headers": {
+        "X-OriAI-Api-Key": "${env:ORIGINMIND_API_KEY}"
+      }
+    }
+  }
+}
+```
+
+Hosted production URL (e.g. on `api.originmind.ai`) is not shipped yet — local HTTP first.
+
+## Cursor — stdio (alternative)
+
+Avoids a long-running process; `npx` can be slow on some networks:
 
 ```json
 {
@@ -44,23 +66,19 @@ Local checkout (this monorepo):
 }
 ```
 
-If the key is missing, tools return a `MISSING_KEY` error pointing at OAuth setup.
+Or `npx -y @gloriginmind/mcp` (pulls latest; first connect may be slow).
 
 ## Transports
 
 | Transport | Entry | Use |
 |-----------|-------|-----|
-| **stdio** | `originmind-mcp` / `dist/stdio.js` | Cursor |
-| **HTTP** | `originmind-mcp-http` / `dist/http.js` | LiveKit `MCPServerHTTP` (future) |
-
-HTTP defaults: `ORIGINMIND_MCP_HOST=127.0.0.1`, `ORIGINMIND_MCP_PORT=3920`, path `/mcp`, health `GET /health`.
+| **HTTP** | `originmind-mcp-http` / `dist/http.js` | Cursor `url`, LiveKit `MCPServerHTTP` |
+| **stdio** | `mcp` / `originmind-mcp` / `dist/stdio.js` | Cursor command |
 
-Per-request auth: prefer `Authorization: Bearer <session JWT>`; else fall back to `ORIGINMIND_API_KEY`.
+Health: `GET /health`.
 
 ### LiveKit (documented, not wired this pass)
 
-When the HTTP server is running:
-
 ```python
 from livekit.agents import mcp
 
@@ -70,8 +88,6 @@ mcp.MCPServerHTTP(
 )
 ```
 
-Do not attach alongside the existing `@function_tool`s until you choose which surface wins (avoids duplicate tools).
-
 ## Tools
 
 **Read:** `list_projects`, `search_creative_dna`, `list_conversations`, `list_messages`, `get_transcript`  
@@ -79,17 +95,14 @@ Do not attach alongside the existing `@function_tool`s until you choose which su
 **Creations:** `list_creations`, `get_creation`, `create_creation`, `update_creation`  
 **References:** `list_references`, `create_reference`
 
-Same routes as [search-creative-dna/references/routes.md](../search-creative-dna/references/routes.md).
-
-**Creations** use the creations API (`list_creations` / `get_creation` / `create_creation` / `update_creation`). Notion tools are **not** exposed here (parked).
+Notion tools are **not** exposed (parked).
 
 ## Dev
 
 ```bash
 cd skills/mcp
-npm install   # may need corporate TLS workaround
+npm install
 npm run build
 npm test
-npm start           # stdio
-npm run start:http  # HTTP
+npm run start:http
 ```

package/dist/auth.d.ts

@@ -8,6 +8,8 @@ export type AuthCred = {
  */
 export declare function resolveAuth(options?: {
     authorizationHeader?: string | null;
+    /** Optional X-OriAI-Api-Key from HTTP clients (e.g. Cursor headers). */
+    apiKeyHeader?: string | null;
     cwd?: string;
     /** Override machine env path; pass `null` to skip (~/.originmind/.env). */
     machineEnvPath?: string | null;

package/dist/auth.js

@@ -42,6 +42,10 @@ export function resolveAuth(options) {
             return { kind: "api_key", value: header };
         }
     }
+    const apiKeyHeader = options?.apiKeyHeader?.trim();
+    if (apiKeyHeader) {
+        return { kind: "api_key", value: apiKeyHeader };
+    }
     if (process.env.ORIGINMIND_API_KEY?.trim()) {
         return { kind: "api_key", value: process.env.ORIGINMIND_API_KEY.trim() };
     }

package/dist/http.js

@@ -32,8 +32,11 @@ function readJsonBody(req) {
 }
 async function handleMcp(req, res) {
     const authHeader = typeof req.headers.authorization === "string" ? req.headers.authorization : null;
+    const apiKeyRaw = req.headers["x-oriai-api-key"];
+    const apiKeyHeader = typeof apiKeyRaw === "string" ? apiKeyRaw : Array.isArray(apiKeyRaw) ? apiKeyRaw[0] : null;
     const server = createMcpServer({
         getAuthorizationHeader: () => authHeader,
+        getApiKeyHeader: () => apiKeyHeader,
     });
     const transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: undefined,

package/dist/tools.d.ts

@@ -3,6 +3,10 @@ import { z } from "zod";
 export type ToolAuthContext = {
     /** Per-request Authorization header (HTTP transport). */
     getAuthorizationHeader?: () => string | null | undefined;
+    /** Per-request X-OriAI-Api-Key (HTTP / Cursor headers). */
+    getApiKeyHeader?: () => string | null | undefined;
+    /** Override API base URL (orchestrator self-call / local). */
+    baseUrl?: string;
 };
 /** Zod shapes exported for unit tests. */
 export declare const toolSchemas: {

package/dist/tools.js

@@ -10,10 +10,13 @@ function errorResult(message) {
     return { content: [{ type: "text", text: message }], isError: true };
 }
 function clientFor(ctx) {
-    const auth = resolveAuth({ authorizationHeader: ctx.getAuthorizationHeader?.() ?? null });
+    const auth = resolveAuth({
+        authorizationHeader: ctx.getAuthorizationHeader?.() ?? null,
+        apiKeyHeader: ctx.getApiKeyHeader?.() ?? null,
+    });
     if ("error" in auth)
         return { error: MISSING_KEY_MESSAGE };
-    return new OriginMindClient(auth);
+    return new OriginMindClient(auth, ctx.baseUrl);
 }
 async function runTool(ctx, fn) {
     const client = clientFor(ctx);
@@ -103,7 +106,7 @@ export const toolSchemas = {
 export function createServer(authCtx = {}) {
     const server = new McpServer({
         name: "originmind",
-        version: "0.1.0",
+        version: "0.1.3",
     });
     server.tool("list_projects", "List OriginMind projects for the authenticated user (GET /api/v1/projects).", toolSchemas.list_projects.shape, async () => runTool(authCtx, (c) => c.get("/api/v1/projects")));
     server.tool("search_creative_dna", "Search Creative DNA for a project (POST /api/v1/projects/{id}/query).", toolSchemas.search_creative_dna.shape, async (args) => runTool(authCtx, (c) => c.post(`/api/v1/projects/${encodeURIComponent(args.project_id)}/query`, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gloriginmind/mcp",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "OriginMind MCP server — dual-auth skill routes via Bootstrap OAuth API key",
   "type": "module",
   "bin": {
@@ -9,6 +9,21 @@
     "originmind-mcp-http": "dist/http.js"
   },
   "main": "./dist/stdio.js",
+  "exports": {
+    ".": "./dist/stdio.js",
+    "./server": {
+      "types": "./dist/tools.d.ts",
+      "import": "./dist/tools.js"
+    },
+    "./auth": {
+      "types": "./dist/auth.d.ts",
+      "import": "./dist/auth.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js"
+    }
+  },
   "files": [
     "dist",
     "README.md"