@gpsglobal-ai/gpsglobal 1.4.1 → 1.4.4

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog — gpsglobal
 
+## 1.4.4 — 2026-06-18
+
+- CI: disable npm provenance (private GitHub repo — OIDC publish still works)
+
+## 1.4.3 — 2026-06-18
+
+- CI: fix OIDC publish — do not inject `NODE_AUTH_TOKEN` via `setup-node` `registry-url`
+
+## 1.4.2 — 2026-06-18
+
+- **README** — LP-facing install guide, host matrix, security, troubleshooting
+- **LICENSE** — proprietary GPS Global terms (not open source); `SEE LICENSE IN LICENSE`
+
 ## 1.4.1 — 2026-06-17
 
 - **npm scope:** publish as `@gpsglobal-ai/gpsglobal` under org `gpsglobal-ai`

package/LICENSE

@@ -0,0 +1,40 @@
+GPS Global — Proprietary Software License
+@gpsglobal-ai/gpsglobal MCP Server
+
+Copyright (c) 2026 GPS Global. All rights reserved.
+
+NOTICE: This software is NOT open source. Public distribution on npm does not
+grant any rights beyond those expressly stated below.
+
+1. GRANT OF LICENSE
+   Subject to your valid GPS LP Workspace account and applicable agreement
+   with GPS Global (or its affiliates), you are granted a limited,
+   non-exclusive, non-transferable, revocable license to install and use
+   this MCP server package solely to access fund wiki content made available
+   to you through the GPS LP platform.
+
+2. RESTRICTIONS
+   You may not:
+   - copy, modify, merge, publish, distribute, sublicense, or sell this software;
+   - reverse engineer, decompile, or disassemble the software, except where
+     prohibited by applicable law;
+   - use the software to access data belonging to another LP or bypass
+     GPS authentication or authorization controls;
+   - remove or alter proprietary notices.
+
+3. OWNERSHIP
+   GPS Global and its licensors retain all right, title, and interest in and
+   to the software. No rights are granted except as expressly set forth herein.
+
+4. TERMINATION
+   This license terminates automatically if you breach these terms or lose
+   authorized access to the GPS LP platform. Upon termination, you must cease
+   all use and destroy copies in your possession.
+
+5. DISCLAIMER
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.
+
+6. CONTACT
+   Licensing inquiries: https://lp.gpsglobal.ai

package/README.md

@@ -1,33 +1,152 @@
 # @gpsglobal-ai/gpsglobal
 
-GPS LP fund wiki **MCP server** — `list_funds` and `get_fund_wiki` for Cursor, Copilot, and Claude.
+**GPS LP fund wiki MCP server** — connect Cursor, GitHub Copilot, VS Code, and Claude to your GPS fund vault wikis.
 
-| | |
-|--|--|
-| **npm** | `@gpsglobal-ai/gpsglobal` |
-| **MCP server key** | `gpsglobal` |
-| **CLI** | `gpsglobal` (after install) |
+> **Licensed software** — not open source. Use is limited to authorized GPS Limited Partners. See [LICENSE](./LICENSE).
 
-## Quick start
+---
+
+## What it does
+
+This package implements a [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server so AI assistants can read **your** GPS fund knowledge wikis securely:
+
+| Tool | Description |
+|------|-------------|
+| `list_funds` | List funds in your LP vault (with `has_wiki` metadata) |
+| `get_fund_wiki` | Return the full markdown wiki for a fund |
+
+Data never leaves GPS infrastructure except through your authenticated session — the MCP proxies to `https://lp.gpsglobal.ai` with LP-scoped JWT or OAuth tokens.
+
+---
+
+## Who this is for
+
+- **GPS Limited Partners** with access to [LP Workspace](https://lp.gpsglobal.ai)
+- **Not** for GP operators, content managers, or unauthenticated use
+
+---
+
+## Quick start (recommended)
+
+One command — browser sign-in, credentials saved locally, configs merged for major AI hosts:
 
 ```bash
 npx @gpsglobal-ai/gpsglobal setup
 ```
 
-Browser sign-in → `~/.gps/mcp.env` → merges configs for **Cursor**, **VS Code**, and **Claude Desktop**.
+This writes `~/.gps/mcp.env` (mode `600`) and updates **Cursor**, **VS Code**, and **Claude Desktop** configs.
+
+**Restart your AI tool**, then ask: *"List my GPS funds using gpsglobal"*.
+
+### Other commands
+
+| Goal | Command |
+|------|---------|
+| OAuth Connect (URL-only, no token in config) | `npx @gpsglobal-ai/gpsglobal setup --mode=oauth` |
+| Verify install + backend reachability | `npx @gpsglobal-ai/gpsglobal doctor` |
+| Print config snippets for all hosts | `npx @gpsglobal-ai/gpsglobal print-config` |
+| Refresh credentials | `npx @gpsglobal-ai/gpsglobal login --browser --refresh` |
+
+Global install (optional):
+
+```bash
+npm install -g @gpsglobal-ai/gpsglobal
+gpsglobal setup
+```
+
+---
+
+## Supported AI hosts
+
+| Host | Setup mode | Config key |
+|------|------------|------------|
+| **Cursor** | `setup` or `setup --mode=oauth` | `gpsglobal` |
+| **VS Code / GitHub Copilot** | `setup` | `gpsglobal` |
+| **Claude Desktop** | `setup` (stdio) | `gpsglobal` |
+| **Claude Code** | `claude mcp add --transport http gpsglobal https://lp.gpsglobal.ai/mcp` | `gpsglobal` |
 
-| Variant | Command |
-|---------|---------|
-| OAuth Connect (URL-only) | `npx @gpsglobal-ai/gpsglobal setup --mode=oauth` |
-| Health check | `npx @gpsglobal-ai/gpsglobal doctor` |
-| Config snippets | `npx @gpsglobal-ai/gpsglobal print-config` |
+**OAuth Connect (production):** hosts discover auth via `https://lp.gpsglobal.ai/mcp` — no manual JWT paste.
 
-## Docs
+**Cursor example** (`~/.cursor/mcp.json`):
+
+```json
+{
+  "mcpServers": {
+    "gpsglobal": {
+      "url": "https://lp.gpsglobal.ai/mcp"
+    }
+  }
+}
+```
 
-- Repo spec: [`docs/57-mcp/`](../docs/57-mcp/000-INDEX.md)
-- npm publish & CI/CD: [`docs/57-mcp/018-npm-publish-and-cicd.md`](../docs/57-mcp/018-npm-publish-and-cicd.md)
-- Host configuration: [`docs/57-mcp/017-multi-host-oauth-connect.md`](../docs/57-mcp/017-multi-host-oauth-connect.md)
+**Stdio example** (Claude Desktop, local dev):
+
+```json
+{
+  "mcpServers": {
+    "gpsglobal": {
+      "command": "npx",
+      "args": ["-y", "@gpsglobal-ai/gpsglobal", "--stdio"],
+      "envFile": "${userHome}/.gps/mcp.env"
+    }
+  }
+}
+```
+
+---
+
+## Security
+
+- Credentials live in `~/.gps/mcp.env` — **never** commit tokens to git
+- MCP HTTP uses **OAuth 2.1 + PKCE** with scoped tokens (`aud` + `mcp:read`)
+- LP isolation enforced server-side — you only see your own vault
+- OAuth tokens expire after 1 hour; run `login --refresh` or reconnect in your host
+
+---
+
+## Package identity
+
+| | Value |
+|--|-------|
+| npm package | `@gpsglobal-ai/gpsglobal` |
+| MCP server name (in host config) | `gpsglobal` |
+| CLI binary (after global install) | `gpsglobal` |
+| Production MCP endpoint | `https://lp.gpsglobal.ai/mcp` |
+
+---
+
+## Requirements
+
+- Node.js **18+**
+- Valid GPS LP account on [lp.gpsglobal.ai](https://lp.gpsglobal.ai)
+- Network access to the GPS API (local dev: `make dev` stack on ports 8080 / 3100)
+
+---
+
+## Troubleshooting
+
+| Issue | Fix |
+|-------|-----|
+| Tools return 401 | `npx @gpsglobal-ai/gpsglobal login --browser --refresh` |
+| Host shows disconnected | Restart the AI app after `setup` |
+| `doctor` fails | Ensure backend is running; check `GPS_API_BASE` in `~/.gps/mcp.env` |
+| OAuth Connect loop | Confirm Cursor/VS Code config is URL-only (no stale Bearer header) |
+
+---
 
 ## License
 
-UNLICENSED — private GPS software.
+**Proprietary — not open source.**
+
+Copyright © 2026 GPS Global. All rights reserved.
+
+This package is published on npm for convenient installation by **authorized GPS Limited Partners only**. See [LICENSE](./LICENSE) for full terms.
+
+Unauthorized copying, modification, distribution, or reverse engineering is prohibited.
+
+---
+
+## Links
+
+- LP Workspace: https://lp.gpsglobal.ai
+- MCP specification: https://modelcontextprotocol.io

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gpsglobal-ai/gpsglobal",
-  "version": "1.4.1",
+  "version": "1.4.4",
   "description": "GPS LP fund wiki MCP server — list_funds and get_fund_wiki for Cursor, Copilot, Claude",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,7 +19,8 @@
     "dist",
     "templates",
     "README.md",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "LICENSE"
   ],
   "scripts": {
     "build": "tsc",
@@ -52,6 +53,6 @@
     "copilot",
     "claude"
   ],
-  "license": "UNLICENSED",
+  "license": "SEE LICENSE IN LICENSE",
   "private": false
 }