@gpsglobal-ai/gpsglobal 1.4.1 → 1.4.5

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog — gpsglobal
 
+## 1.4.5 — 2026-06-21
+
+- **Production defaults:** `setup` and `login` use `https://lp.gpsglobal.ai` (not `localhost:8080`)
+- **`setup` default mode:** `oauth` — Cursor/VS Code/GitHub get URL-only `https://lp.gpsglobal.ai/mcp`
+- **Claude Desktop:** still gets stdio + `envFile` when mode is `oauth` (Desktop has no reliable HTTP OAuth)
+- **`doctor`:** probes `${apiBase}/mcp` → expects 401 on production (not localhost:3100)
+- Local dev: `GPS_API_BASE=http://localhost:8080 npx @gpsglobal-ai/gpsglobal setup --mode=stdio`
+
+## 1.4.4 — 2026-06-18
+
+- CI: disable npm provenance (private GitHub repo — OIDC publish still works)
+
+## 1.4.3 — 2026-06-18
+
+- CI: fix OIDC publish — do not inject `NODE_AUTH_TOKEN` via `setup-node` `registry-url`
+
+## 1.4.2 — 2026-06-18
+
+- **README** — LP-facing install guide, host matrix, security, troubleshooting
+- **LICENSE** — proprietary GPS Global terms (not open source); `SEE LICENSE IN LICENSE`
+
 ## 1.4.1 — 2026-06-17
 
 - **npm scope:** publish as `@gpsglobal-ai/gpsglobal` under org `gpsglobal-ai`

package/LICENSE

@@ -0,0 +1,40 @@
+GPS Global — Proprietary Software License
+@gpsglobal-ai/gpsglobal MCP Server
+
+Copyright (c) 2026 GPS Global. All rights reserved.
+
+NOTICE: This software is NOT open source. Public distribution on npm does not
+grant any rights beyond those expressly stated below.
+
+1. GRANT OF LICENSE
+   Subject to your valid GPS LP Workspace account and applicable agreement
+   with GPS Global (or its affiliates), you are granted a limited,
+   non-exclusive, non-transferable, revocable license to install and use
+   this MCP server package solely to access fund wiki content made available
+   to you through the GPS LP platform.
+
+2. RESTRICTIONS
+   You may not:
+   - copy, modify, merge, publish, distribute, sublicense, or sell this software;
+   - reverse engineer, decompile, or disassemble the software, except where
+     prohibited by applicable law;
+   - use the software to access data belonging to another LP or bypass
+     GPS authentication or authorization controls;
+   - remove or alter proprietary notices.
+
+3. OWNERSHIP
+   GPS Global and its licensors retain all right, title, and interest in and
+   to the software. No rights are granted except as expressly set forth herein.
+
+4. TERMINATION
+   This license terminates automatically if you breach these terms or lose
+   authorized access to the GPS LP platform. Upon termination, you must cease
+   all use and destroy copies in your possession.
+
+5. DISCLAIMER
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.
+
+6. CONTACT
+   Licensing inquiries: https://lp.gpsglobal.ai

package/README.md

@@ -1,33 +1,158 @@
 # @gpsglobal-ai/gpsglobal
 
-GPS LP fund wiki **MCP server** — `list_funds` and `get_fund_wiki` for Cursor, Copilot, and Claude.
+**GPS LP fund wiki MCP server** — connect Cursor, GitHub Copilot, VS Code, and Claude to your GPS fund vault wikis.
 
-| | |
-|--|--|
-| **npm** | `@gpsglobal-ai/gpsglobal` |
-| **MCP server key** | `gpsglobal` |
-| **CLI** | `gpsglobal` (after install) |
+> **Licensed software** — not open source. Use is limited to authorized GPS Limited Partners. See [LICENSE](./LICENSE).
 
-## Quick start
+---
+
+## What it does
+
+This package implements a [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server so AI assistants can read **your** GPS fund knowledge wikis securely:
+
+| Tool | Description |
+|------|-------------|
+| `list_funds` | List funds in your LP vault (with `has_wiki` metadata) |
+| `get_fund_wiki` | Return the full markdown wiki for a fund |
+
+Data never leaves GPS infrastructure except through your authenticated session — the MCP proxies to `https://lp.gpsglobal.ai` with LP-scoped JWT or OAuth tokens.
+
+---
+
+## Who this is for
+
+- **GPS Limited Partners** with access to [LP Workspace](https://lp.gpsglobal.ai)
+- **Not** for GP operators, content managers, or unauthenticated use
+
+---
+
+## Quick start (recommended)
+
+One command — browser sign-in at **production**, credentials saved locally, configs merged for major AI hosts:
 
 ```bash
 npx @gpsglobal-ai/gpsglobal setup
 ```
 
-Browser sign-in → `~/.gps/mcp.env` → merges configs for **Cursor**, **VS Code**, and **Claude Desktop**.
+This opens `https://lp.gpsglobal.ai` for OAuth, writes `~/.gps/mcp.env` (mode `600`), and updates **Cursor** (OAuth URL), **VS Code**, **GitHub Copilot**, and **Claude Desktop** (stdio) configs.
+
+**Restart your AI tool**, then ask: *"List my GPS funds using gpsglobal"*.
+
+**Local Docker dev** (backend on `localhost:8080`):
+
+```bash
+GPS_API_BASE=http://localhost:8080 npx @gpsglobal-ai/gpsglobal setup --mode=stdio
+```
+
+### Other commands
+
+| Goal | Command |
+|------|---------|
+| stdio-only (all hosts) | `npx @gpsglobal-ai/gpsglobal setup --mode=stdio` |
+| Verify install + backend reachability | `npx @gpsglobal-ai/gpsglobal doctor` |
+| Print config snippets for all hosts | `npx @gpsglobal-ai/gpsglobal print-config` |
+| Refresh credentials | `npx @gpsglobal-ai/gpsglobal login --browser --refresh` |
+
+Global install (optional):
+
+```bash
+npm install -g @gpsglobal-ai/gpsglobal
+gpsglobal setup
+```
+
+---
+
+## Supported AI hosts
 
-| Variant | Command |
-|---------|---------|
-| OAuth Connect (URL-only) | `npx @gpsglobal-ai/gpsglobal setup --mode=oauth` |
-| Health check | `npx @gpsglobal-ai/gpsglobal doctor` |
-| Config snippets | `npx @gpsglobal-ai/gpsglobal print-config` |
+| Host | Setup mode | Config key |
+|------|------------|------------|
+| **Cursor** | `setup` (default oauth) | `gpsglobal` |
+| **VS Code / GitHub Copilot** | `setup` | `gpsglobal` |
+| **Claude Desktop** | `setup` (stdio via envFile) | `gpsglobal` |
+| **Claude Code** | `claude mcp add --transport http gpsglobal https://lp.gpsglobal.ai/mcp` | `gpsglobal` |
 
-## Docs
+**OAuth Connect (production):** hosts discover auth via `https://lp.gpsglobal.ai/mcp` — no manual JWT paste.
 
-- Repo spec: [`docs/57-mcp/`](../docs/57-mcp/000-INDEX.md)
-- npm publish & CI/CD: [`docs/57-mcp/018-npm-publish-and-cicd.md`](../docs/57-mcp/018-npm-publish-and-cicd.md)
-- Host configuration: [`docs/57-mcp/017-multi-host-oauth-connect.md`](../docs/57-mcp/017-multi-host-oauth-connect.md)
+**Cursor example** (`~/.cursor/mcp.json`):
+
+```json
+{
+  "mcpServers": {
+    "gpsglobal": {
+      "url": "https://lp.gpsglobal.ai/mcp"
+    }
+  }
+}
+```
+
+**Stdio example** (Claude Desktop, local dev):
+
+```json
+{
+  "mcpServers": {
+    "gpsglobal": {
+      "command": "npx",
+      "args": ["-y", "@gpsglobal-ai/gpsglobal", "--stdio"],
+      "envFile": "${userHome}/.gps/mcp.env"
+    }
+  }
+}
+```
+
+---
+
+## Security
+
+- Credentials live in `~/.gps/mcp.env` — **never** commit tokens to git
+- MCP HTTP uses **OAuth 2.1 + PKCE** with scoped tokens (`aud` + `mcp:read`)
+- LP isolation enforced server-side — you only see your own vault
+- OAuth tokens expire after 1 hour; run `login --refresh` or reconnect in your host
+
+---
+
+## Package identity
+
+| | Value |
+|--|-------|
+| npm package | `@gpsglobal-ai/gpsglobal` |
+| MCP server name (in host config) | `gpsglobal` |
+| CLI binary (after global install) | `gpsglobal` |
+| Production MCP endpoint | `https://lp.gpsglobal.ai/mcp` |
+
+---
+
+## Requirements
+
+- Node.js **18+**
+- Valid GPS LP account on [lp.gpsglobal.ai](https://lp.gpsglobal.ai)
+- Network access to the GPS API (local dev: `make dev` stack on ports 8080 / 3100)
+
+---
+
+## Troubleshooting
+
+| Issue | Fix |
+|-------|-----|
+| Tools return 401 | `npx @gpsglobal-ai/gpsglobal login --browser --refresh` |
+| Host shows disconnected | Restart the AI app after `setup` |
+| `doctor` fails | Ensure you are whitelisted on prod; check `GPS_API_BASE` in `~/.gps/mcp.env` (should be `https://lp.gpsglobal.ai`) |
+| OAuth Connect loop | Confirm Cursor/VS Code config is URL-only (no stale Bearer header) |
+
+---
 
 ## License
 
-UNLICENSED — private GPS software.
+**Proprietary — not open source.**
+
+Copyright © 2026 GPS Global. All rights reserved.
+
+This package is published on npm for convenient installation by **authorized GPS Limited Partners only**. See [LICENSE](./LICENSE) for full terms.
+
+Unauthorized copying, modification, distribution, or reverse engineering is prohibited.
+
+---
+
+## Links
+
+- LP Workspace: https://lp.gpsglobal.ai
+- MCP specification: https://modelcontextprotocol.io

package/dist/cli/doctor.js

@@ -2,6 +2,7 @@ import axios from 'axios';
 import { GpsApiClient } from '../clients/gps-api.js';
 import { loadGpsConfig, normalizeApiBase, DEFAULT_ENV_PATH } from '../config/env.js';
 import { decodeGpsJwt } from '../lib/jwt.js';
+import { resolveMcpPublicUrl } from '../lib/host-config.js';
 export async function runDoctor() {
     const checks = [];
     let config;
@@ -53,22 +54,29 @@ export async function runDoctor() {
             detail: err instanceof Error ? err.message : String(err),
         });
     }
-    const mcpUrl = process.env.GPS_MCP_PUBLIC_URL ?? 'http://localhost:3100';
+    const mcpUrl = resolveMcpPublicUrl(config.apiBase);
     try {
-        const mcpHealth = await axios.get(`${mcpUrl}/health`, { timeout: 5_000, validateStatus: () => true });
-        if (mcpHealth.status === 404) {
-            checks.push({ name: 'mcp-http', ok: true, detail: 'not running (stdio mode OK)' });
+        const mcpProbe = await axios.get(`${mcpUrl}/mcp`, {
+            timeout: 10_000,
+            validateStatus: () => true,
+            maxRedirects: 0,
+        });
+        if (mcpProbe.status === 401) {
+            checks.push({ name: 'mcp-http', ok: true, detail: `${mcpUrl}/mcp → 401 (discovery OK)` });
+        }
+        else if (mcpProbe.status === 404) {
+            checks.push({ name: 'mcp-http', ok: true, detail: 'stdio mode (no remote /mcp)' });
         }
         else {
             checks.push({
                 name: 'mcp-http',
-                ok: mcpHealth.status === 200,
-                detail: `${mcpUrl}/health → ${mcpHealth.status}`,
+                ok: mcpProbe.status === 200,
+                detail: `${mcpUrl}/mcp → ${mcpProbe.status}`,
             });
         }
     }
     catch {
-        checks.push({ name: 'mcp-http', ok: true, detail: 'not running (stdio mode OK)' });
+        checks.push({ name: 'mcp-http', ok: true, detail: 'remote MCP unreachable (stdio mode OK)' });
     }
     return { ok: checks.every((c) => c.ok), checks };
 }

package/dist/cli/setup.js

@@ -1,13 +1,14 @@
 import { browserLogin } from './browser-login.js';
-import { DEFAULT_ENV_PATH, normalizeApiBase } from '../config/env.js';
+import { DEFAULT_ENV_PATH, LOCAL_GPS_API_BASE, normalizeApiBase, resolveDefaultApiBase } from '../config/env.js';
 import { MCP_SERVER_KEY, PACKAGE, claudeCodeAddCommand, mergeVsCodeConfig, mergeVsCodeWorkspaceConfig, mergeClaudeDesktopConfig, mergeCursorConfig, buildOAuthConnectEntry, buildRemoteEntry, buildStdioEntry, resolveMcpPublicUrl, writeAllHostConfigs, } from '../lib/host-config.js';
 export async function runSetup(options) {
-    const apiBase = normalizeApiBase(options.apiBase ?? process.env.GPS_API_BASE ?? 'http://localhost:8080');
+    const apiBase = normalizeApiBase(options.apiBase ?? resolveDefaultApiBase());
     const host = options.host ?? 'all';
     const useBrowser = options.useBrowser ?? true;
-    const mode = options.mode ?? 'stdio';
+    const mode = options.mode ?? 'oauth';
     const mcpPublic = resolveMcpPublicUrl(apiBase);
-    console.log(`GPS MCP setup — configure ${MCP_SERVER_KEY} for your AI tools\n`);
+    console.log(`GPS MCP setup — configure ${MCP_SERVER_KEY} for your AI tools`);
+    console.log(`  API: ${apiBase}  ·  MCP: ${mcpPublic}/mcp  ·  mode: ${mode}\n`);
     if (useBrowser) {
         const result = await browserLogin(apiBase);
         console.log(`\n✓ Signed in as ${result.username} (${result.lpId})`);
@@ -48,5 +49,6 @@ export async function runSetup(options) {
         console.log(`\nRun:\n  ${claudeCodeAddCommand(mcpPublic, mode === 'oauth' ? 'oauth' : 'remote')}`);
     }
     console.log(`\nVerify: npx ${PACKAGE} doctor`);
+    console.log(`Local dev: GPS_API_BASE=${LOCAL_GPS_API_BASE} npx ${PACKAGE} setup --mode=stdio`);
     console.log(`Done. Ask your AI: "list my GPS funds using ${MCP_SERVER_KEY}"`);
 }

package/dist/cli.js

@@ -2,14 +2,14 @@
 import readline from 'node:readline/promises';
 import { stdin as input, stdout as output } from 'node:process';
 import { GpsApiClient } from './clients/gps-api.js';
-import { DEFAULT_ENV_PATH, loadGpsConfig, normalizeApiBase, writeGpsEnvFile, } from './config/env.js';
+import { DEFAULT_ENV_PATH, loadGpsConfig, resolveDefaultApiBase, writeGpsEnvFile, } from './config/env.js';
 import { startStdioServer, startHttpFromEnv } from './index.js';
 import { browserLogin } from './cli/browser-login.js';
 import { runSetup } from './cli/setup.js';
 import { runDoctor, printDoctor } from './cli/doctor.js';
 import { MCP_SERVER_KEY, PACKAGE, buildMcpServersConfig, buildOAuthConnectEntry, buildRemoteEntry, buildStdioEntry, buildVsCodeServersConfig, resolveMcpPublicUrl, } from './lib/host-config.js';
 function printConfig(envPath) {
-    const apiBase = normalizeApiBase(process.env.GPS_API_BASE ?? 'http://localhost:8080');
+    const apiBase = resolveDefaultApiBase();
     const mcpPublic = resolveMcpPublicUrl(apiBase);
     const stdio = buildStdioEntry(envPath);
     const remote = buildRemoteEntry(mcpPublic);
@@ -17,7 +17,7 @@ function printConfig(envPath) {
     console.log(`
 ═══ Easiest: one command (all major hosts) ═══
   npx ${PACKAGE} setup
-  npx ${PACKAGE} setup --mode=oauth   ← OAuth Connect (URL-only)
+  npx ${PACKAGE} setup --mode=stdio   ← local dev / Claude Desktop stdio-only
 
 ═══ Cursor / Claude Desktop (mcpServers) ═══
 ${JSON.stringify(buildMcpServersConfig(stdio), null, 2)}
@@ -46,7 +46,7 @@ async function promptHidden(question) {
     }
 }
 async function runLogin(refresh, useBrowser) {
-    const apiBase = normalizeApiBase(process.env.GPS_API_BASE ?? 'http://localhost:8080');
+    const apiBase = resolveDefaultApiBase();
     if (useBrowser) {
         const result = await browserLogin(apiBase);
         console.log(`\n✓ Credentials saved to ${DEFAULT_ENV_PATH}`);
@@ -109,8 +109,8 @@ async function main() {
     const cmd = args[0];
     if (!cmd || cmd === 'help' || args.includes('--help')) {
         console.log(`Usage:
-  npx ${PACKAGE} setup              ← easiest: all hosts (Cursor, VS Code, Claude Desktop)
-  npx ${PACKAGE} setup --mode=oauth ← Cursor Connect (URL-only, no envFile)
+  npx ${PACKAGE} setup              ← production OAuth Connect (https://lp.gpsglobal.ai/mcp)
+  npx ${PACKAGE} setup --mode=stdio ← local dev (GPS_API_BASE=http://localhost:8080)
   npx ${PACKAGE} doctor             ← verify credentials + backend
   npx ${PACKAGE} login [--browser] [--refresh]
   npx ${PACKAGE} status
@@ -128,7 +128,7 @@ async function main() {
         await runSetup({
             host: host ?? 'all',
             useBrowser: !args.includes('--no-browser'),
-            mode: mode ?? 'stdio',
+            mode: mode ?? 'oauth',
         });
         return;
     }

package/dist/config/env.d.ts

@@ -1,4 +1,10 @@
 export declare const DEFAULT_ENV_PATH: string;
+/** Production LP Workspace origin — default for published npm package. */
+export declare const DEFAULT_GPS_API_BASE = "https://lp.gpsglobal.ai";
+/** Local Docker backend — opt-in via GPS_API_BASE for developers only. */
+export declare const LOCAL_GPS_API_BASE = "http://localhost:8080";
+/** Resolve API base: explicit env → production (not localhost). */
+export declare function resolveDefaultApiBase(): string;
 export interface GpsEnvConfig {
     apiBase: string;
     accessToken: string;

package/dist/config/env.js

@@ -2,6 +2,14 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 export const DEFAULT_ENV_PATH = path.join(os.homedir(), '.gps', 'mcp.env');
+/** Production LP Workspace origin — default for published npm package. */
+export const DEFAULT_GPS_API_BASE = 'https://lp.gpsglobal.ai';
+/** Local Docker backend — opt-in via GPS_API_BASE for developers only. */
+export const LOCAL_GPS_API_BASE = 'http://localhost:8080';
+/** Resolve API base: explicit env → production (not localhost). */
+export function resolveDefaultApiBase() {
+    return normalizeApiBase(process.env.GPS_API_BASE ?? DEFAULT_GPS_API_BASE);
+}
 export function parseEnvFile(content) {
     const out = {};
     for (const line of content.split('\n')) {
@@ -36,7 +44,7 @@ export function loadGpsConfig(envPath = process.env.GPS_MCP_ENV_PATH ?? DEFAULT_
     }
     const parsed = parseEnvFile(fs.readFileSync(envPath, 'utf8'));
     const merged = {
-        apiBase: normalizeApiBase(parsed.GPS_API_BASE ?? 'http://localhost:8080'),
+        apiBase: normalizeApiBase(parsed.GPS_API_BASE ?? DEFAULT_GPS_API_BASE),
         accessToken: parsed.GPS_ACCESS_TOKEN ?? '',
         lpId: parsed.GPS_LP_ID ?? '',
         role: parsed.GPS_ROLE ?? 'lp',

package/dist/http.d.ts

@@ -3,6 +3,9 @@ export interface HttpServerOptions {
     host: string;
     apiBase: string;
     publicBaseUrl: string;
+    /** Public GPS API origin for OAuth AS in PRM (defaults to publicBaseUrl). */
+    publicApiBase?: string;
     enabled: boolean;
+    version?: string;
 }
 export declare function startHttpServer(opts: HttpServerOptions): Promise<void>;

package/dist/http.js

@@ -5,6 +5,7 @@ import { assertMcpEligibleRole } from './config/env.js';
 import { createGpsMcpServer } from './server/factory.js';
 import { decodeGpsJwt } from './lib/jwt.js';
 import { assertMcpHttpToken } from './lib/token-policy.js';
+import { oauthAuthorizationServerUrl, resolvePublicApiBase } from './lib/public-api-base.js';
 function parseBearer(req) {
     const h = req.headers.authorization;
     if (!h?.startsWith('Bearer '))
@@ -28,15 +29,21 @@ function sendUnauthorized(res, resourceMetadataUrl, message) {
 export async function startHttpServer(opts) {
     const app = createMcpExpressApp({ host: opts.host });
     const resourceMetadataUrl = `${opts.publicBaseUrl}/.well-known/oauth-protected-resource`;
-    const authServer = `${opts.apiBase}/api/v2/oauth/mcp-cli`;
+    const publicApiBase = resolvePublicApiBase(opts.publicApiBase, opts.publicBaseUrl);
+    const authServer = oauthAuthorizationServerUrl(publicApiBase);
+    const serviceVersion = opts.version ?? process.env.GPS_MCP_VERSION ?? '1.4.4';
     app.get('/health', (_req, res) => {
         if (!opts.enabled) {
             res.status(503).json({ status: 'disabled', message: 'GPS MCP HTTP is disabled' });
             return;
         }
-        res.json({ status: 'ok', service: 'gpsglobal', version: '1.4.0' });
+        res.json({ status: 'ok', service: 'gpsglobal', version: serviceVersion });
     });
     app.get('/.well-known/oauth-protected-resource', (_req, res) => {
+        if (!opts.enabled) {
+            res.status(503).json({ error: 'GPS MCP is temporarily disabled' });
+            return;
+        }
         res.json({
             resource: `${opts.publicBaseUrl}/mcp`,
             authorization_servers: [authServer],

package/dist/index.js

@@ -1,6 +1,6 @@
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { GpsApiClient } from './clients/gps-api.js';
-import { loadGpsConfig, normalizeApiBase } from './config/env.js';
+import { loadGpsConfig, normalizeApiBase, LOCAL_GPS_API_BASE } from './config/env.js';
 import { createGpsMcpServer } from './server/factory.js';
 import { startHttpServer } from './http.js';
 export async function startStdioServer() {
@@ -13,8 +13,17 @@ export async function startStdioServer() {
 export async function startHttpFromEnv() {
     const port = Number(process.env.PORT ?? 3100);
     const host = process.env.MCP_HOST ?? '0.0.0.0';
-    const apiBase = normalizeApiBase(process.env.GPS_API_BASE ?? 'http://localhost:8080');
+    const apiBase = normalizeApiBase(process.env.GPS_API_BASE ?? LOCAL_GPS_API_BASE);
     const publicBaseUrl = normalizeApiBase(process.env.GPS_MCP_PUBLIC_URL ?? `http://localhost:${port}`);
+    const publicApiBase = normalizeApiBase(process.env.GPS_MCP_PUBLIC_API_BASE ?? publicBaseUrl);
     const enabled = process.env.GPS_MCP_ENABLED !== 'false';
-    await startHttpServer({ port, host, apiBase, publicBaseUrl, enabled });
+    await startHttpServer({
+        port,
+        host,
+        apiBase,
+        publicBaseUrl,
+        publicApiBase,
+        enabled,
+        version: process.env.GPS_MCP_VERSION,
+    });
 }

package/dist/lib/host-config.js

@@ -5,6 +5,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { DEFAULT_GPS_API_BASE } from '../config/env.js';
 /** npm scoped package under org gpsglobal-ai (see docs/57-mcp/018-npm-publish-and-cicd.md). */
 export const NPM_PACKAGE = '@gpsglobal-ai/gpsglobal';
 /** MCP protocol server key in mcp.json — short, stable across hosts. */
@@ -133,7 +134,7 @@ export function resolveMcpPublicUrl(apiBase) {
     if (normalized.includes('localhost') || normalized.includes('127.0.0.1')) {
         return process.env.GPS_MCP_PUBLIC_URL ?? 'http://localhost:3100';
     }
-    return process.env.GPS_MCP_PUBLIC_URL ?? 'https://lp.gpsglobal.ai';
+    return process.env.GPS_MCP_PUBLIC_URL ?? (normalized || DEFAULT_GPS_API_BASE);
 }
 export function claudeCodeAddCommand(mcpPublicUrl, mode = 'oauth') {
     const url = `${mcpPublicUrl.replace(/\/+$/, '')}/mcp`;
@@ -172,7 +173,8 @@ export function writeAllHostConfigs(envPath, mode, mcpPublicUrl, projectRoot = p
     catch {
         results.push({ host: 'vscode', path: vscodeUserMcpPath(), written: false });
     }
-    if (mode === 'stdio') {
+    // Claude Desktop has no reliable remote HTTP + OAuth — always stdio + envFile.
+    if (mode === 'stdio' || mode === 'oauth') {
         try {
             results.push({
                 host: 'claude-desktop',

package/dist/lib/public-api-base.d.ts

@@ -0,0 +1,3 @@
+/** Public GPS API origin for OAuth PRM (external clients). Internal GPS_API_BASE may differ in ECS. */
+export declare function resolvePublicApiBase(publicApiBase: string | undefined, publicMcpUrl: string): string;
+export declare function oauthAuthorizationServerUrl(publicApiBase: string): string;

package/dist/lib/public-api-base.js

@@ -0,0 +1,8 @@
+/** Public GPS API origin for OAuth PRM (external clients). Internal GPS_API_BASE may differ in ECS. */
+export function resolvePublicApiBase(publicApiBase, publicMcpUrl) {
+    const base = (publicApiBase ?? publicMcpUrl).replace(/\/+$/, '');
+    return base;
+}
+export function oauthAuthorizationServerUrl(publicApiBase) {
+    return `${publicApiBase.replace(/\/+$/, '')}/api/v2/oauth/mcp-cli`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gpsglobal-ai/gpsglobal",
-  "version": "1.4.1",
+  "version": "1.4.5",
   "description": "GPS LP fund wiki MCP server — list_funds and get_fund_wiki for Cursor, Copilot, Claude",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,7 +19,8 @@
     "dist",
     "templates",
     "README.md",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "LICENSE"
   ],
   "scripts": {
     "build": "tsc",
@@ -52,6 +53,6 @@
     "copilot",
     "claude"
   ],
-  "license": "UNLICENSED",
+  "license": "SEE LICENSE IN LICENSE",
   "private": false
 }