@havesomecode/kibana-mcp-server 0.1.0 → 1.1.0

package/README.md

@@ -21,13 +21,16 @@ It is designed as a general-purpose log investigation MCP for environments where
 
 ## Project Status
 
-This repo targets external adoption and AI-agent usability. It is safe for real investigations, but the install and release posture is still evolving.
+This repo is live for external adoption and AI-agent use.
+
+- Homepage: `https://havesomecode.github.io/kibana-mcp-server/`
+- Published package: `npx -y @havesomecode/kibana-mcp-server`
+- Repo-local Codex plugin install remains a first-class path for cloned checkouts
 
 - Guaranteed: repo-local Codex plugin install (see `INSTALL.md`)
 - Guaranteed: guided machine setup through `npm run setup`
-- In progress: package binary contract for agent-friendly `npx` execution
-- In progress: semantic-release automation for tags, npm publish, and GitHub Releases
-- Planned: first public package release after trusted publishing is enabled
+- Available: published package install via `npx -y @havesomecode/kibana-mcp-server`
+- Active: semantic-release automation for tags, npm publish, and GitHub Releases
 - Support posture and compatibility details live in `docs/project/support-policy.md`
 - Contributing and security reporting live in `CONTRIBUTING.md` and `SECURITY.md`
 
@@ -38,6 +41,7 @@ This repo targets external adoption and AI-agent usability. It is safe for real
 - Release checklist: `docs/project/release-checklist.md`
 - npm publishing setup: `docs/project/npm-publishing.md`
 - GitHub Releases are the canonical release notes and version record
+- The `version` field in `package.json` inside git is not the release source of truth
 
 ## Installation
 
@@ -51,7 +55,7 @@ npm run setup
 
 This repo includes a repo-scoped Codex plugin so a cloned checkout can install the MCP without any extra packaging or hosted infrastructure.
 
-The packaged CLI surface is also prepared for a future public install path. Once npm publishing is enabled, AI agents will be able to run the server with `npx -y @havesomecode/kibana-mcp-server` instead of cloning the repo first.
+If you do not need the repo-local plugin workflow, the published package is already available through `npx -y @havesomecode/kibana-mcp-server`.
 
 ### Quick path
 

package/dist/src/config.js

@@ -74,6 +74,14 @@ export const sourceDefinitionSchema = z.object({
 export const sourceCatalogSchema = z.object({
     sources: z.array(sourceDefinitionSchema).min(1),
 });
+function buildKibanaConfig(env) {
+    return {
+        baseUrl: env.KIBANA_BASE_URL.replace(/\/+$/, ""),
+        username: env.KIBANA_USERNAME,
+        password: env.KIBANA_PASSWORD,
+        timeoutMs: env.KIBANA_TIMEOUT_MS ?? 10000,
+    };
+}
 export function resolveSourceCatalogPath(envInput = process.env) {
     const explicitPath = envInput.KIBANA_SOURCE_CATALOG_PATH?.trim();
     if (explicitPath) {
@@ -85,12 +93,7 @@ export function parseAppConfig(envInput, sourceCatalogInput) {
     const env = bootstrapEnvSchema.parse(envInput);
     const sourceCatalog = sourceCatalogSchema.parse(sourceCatalogInput);
     return {
-        kibana: {
-            baseUrl: env.KIBANA_BASE_URL.replace(/\/+$/, ""),
-            username: env.KIBANA_USERNAME,
-            password: env.KIBANA_PASSWORD,
-            timeoutMs: env.KIBANA_TIMEOUT_MS ?? 10000,
-        },
+        kibana: buildKibanaConfig(env),
         sources: sourceCatalog.sources,
     };
 }
@@ -105,7 +108,7 @@ export async function loadConfigFromEnvironment(envInput = process.env, dependen
         const sourceCatalog = await loadSourceCatalog(preferredPath === DEFAULT_RUNTIME_SOURCE_CATALOG_PATH
             ? [preferredPath, DEFAULT_STATIC_SOURCE_CATALOG_PATH]
             : [preferredPath], readFileImpl);
-        const config = parseAppConfig(overrides, sourceCatalog);
+        const config = parseAppConfig(overrides, sourceCatalog.value);
         return {
             ...config,
             sourceCatalogPath: preferredPath,

package/docs/project/compatibility-matrix.md

@@ -17,6 +17,6 @@ This matrix distinguishes guaranteed support from best-effort behavior. Each cla
 | `elasticsearch_search` backend | Guaranteed | Verified in tests | Direct Elasticsearch-compatible search path. |
 | Schema metadata endpoints | Best-effort | Known 404s in some deployments | `describe_fields` may fail if endpoints are blocked. |
 | Nested query features | Best-effort | Depends on schema availability | Requires schema metadata for validation. |
-| Public package install | Planned | Not yet verified | Enabled after artifact verification and release automation. |
+| Public package install | Guaranteed | Published on npm and verified through packlist, release-contract, and release automation checks | Direct machine setup uses `npx -y @havesomecode/kibana-mcp-server`. |
 
 Upgrade a row from best-effort to guaranteed only after verifying it in CI or in a reproducible environment test and documenting the evidence here.

package/docs/project/distribution-strategy.md

@@ -10,7 +10,7 @@ updated: 2026-04-09
 
 - Make the MCP installable by AI agents without manual explanation.
 - Preserve the repo-local Codex plugin workflow as the guaranteed path.
-- Offer a public distribution path once the artifact boundary is verified.
+- Keep the public package path healthy and aligned with the repo-local workflow.
 
 ## Supported Distribution Paths
 
@@ -25,14 +25,14 @@ This is the primary, always-supported path:
 
 This path is required for development and is the baseline for support.
 
-### 2. Public package (planned, gated)
+### 2. Public package
 
-The package surface is prepared for agent-friendly execution via:
+The package is published for agent-friendly execution via:
 
 - `npx -y @havesomecode/kibana-mcp-server`
 - MCP clients that invoke the published package binary instead of a repo-local build
 
-Public publishing remains gated until the following are complete:
+This path depends on the following remaining true:
 
 - npm package ownership is under maintainer control for the chosen package name
 - Verified `npm pack` contents (runtime entrypoint, plugin metadata, README, LICENSE).
@@ -40,7 +40,7 @@ Public publishing remains gated until the following are complete:
 - Clear support policy and compatibility matrix published.
 - Trusted publishing enabled (OIDC), no long-lived publish tokens.
 
-This path is optional until explicitly enabled.
+This path is live and should stay aligned with the repo-local install story and the hosted homepage.
 
 ## Artifact Boundary
 
@@ -67,12 +67,13 @@ The authoritative release record is:
 - GitHub Releases
 
 The repository does not commit generated version bumps or release notes back into git.
+The `version` field in `package.json` on `master` is therefore a source manifest value, not an authoritative shipped version.
 
-## Decision Triggers
+## Ongoing Obligations
 
-Move from repo-local only to public publishing when:
+Keep public publishing healthy by ensuring all of the following remain true:
 
-- the repo has an npm package identity maintainers can actually control
-- at least one external adopter confirms successful installation without maintainer intervention
-- artifact verification passes on two consecutive release candidates
-- maintainer agrees to own the support posture defined in `docs/project/support-policy.md`
+- the npm package identity stays under maintainer control
+- `npm run verify` continues to enforce the published artifact boundary
+- release automation remains green on the supported Node line
+- the hosted homepage, repo-local install path, and support policy describe the same install contract

package/docs/project/npm-publishing.md

@@ -6,7 +6,7 @@ updated: 2026-04-09
 
 # npm Publishing Setup
 
-This repo is prepared for npm trusted publishing from GitHub Actions, but npm-side setup is still required before the first successful publish.
+This repo publishes to npm from GitHub Actions using trusted publishing.
 
 ## Package Identity
 
@@ -33,19 +33,19 @@ It is responsible for:
 
 ## npm-Side Setup
 
-After package ownership is resolved:
+For future maintenance:
 
 1. Open the package settings on npmjs.com.
 2. Add a trusted publisher.
 3. Choose GitHub Actions.
 4. Set:
-   - Organization or user: `Zacaria`
+   - Organization or user: `Havesomecode`
    - Repository: `kibana-mcp-server`
    - Workflow filename: `release.yml`
    - Environment name: leave blank unless GitHub environments are added later
 5. Save the trusted publisher.
 6. Merge a PR into `master` with a semantic title such as `feat: ...` or `fix: ...`.
-7. After the first successful publish, disable token-based publishing in npm package settings.
+7. Keep token-based publishing disabled in npm package settings after trusted publishing is verified.
 
 ## Publish Expectations
 
@@ -55,3 +55,4 @@ After package ownership is resolved:
 - The package `repository` field must match this public GitHub repository exactly.
 - The npm package name in `package.json` must stay aligned with the package configured in npm trusted publishers.
 - Squash merge should be enabled so the semantic PR title becomes the final commit title on `master`.
+- The published version is determined by `semantic-release` and recorded in npm, tags, and GitHub Releases; the `package.json` version committed in git is not the canonical released version.

package/docs/project/release-checklist.md

@@ -12,7 +12,9 @@ updated: 2026-04-09
 - `npm run verify` passes locally.
 - The compatibility matrix is up to date (`docs/project/compatibility-matrix.md`).
 - Any new env or config requirements are documented in `README.md` and `INSTALL.md`.
+- The hosted homepage still matches the supported install paths and support posture.
 - The npm scope and package name (`@havesomecode/kibana-mcp-server`) are owned by the maintainers.
+- Maintainers understand that released versions are tracked in npm, tags, and GitHub Releases, not by the `package.json` version committed in git.
 
 ## Release Authorization
 
@@ -44,8 +46,11 @@ updated: 2026-04-09
 5. Merge with squash merge into `master`.
 6. Confirm the `Release` workflow either exits with no release or publishes a new version.
 7. Validate the Git tag, GitHub Release notes, published package contents, and provenance.
+8. Confirm the `Pages` workflow still deploys the homepage surface and that the install copy remains truthful.
 
 ## Post-Release
 
 - Confirm install instructions still match the shipped artifact.
+- Confirm the hosted homepage still matches the shipped artifact and current support posture.
 - Update any compatibility claims that changed in the release.
+- If docs mention a specific current version, verify it against npm or GitHub Releases rather than reading `package.json` in git.

package/docs/project/support-policy.md

@@ -23,7 +23,7 @@ This MCP is designed for operators and AI agents that need read-only access to K
 - Fully autonomous repo-local plugin installation by prompting alone across all Codex model variants
 - Schema metadata endpoints (`kibana_data_views_fields`, `kibana_index_patterns_fields`, `elasticsearch_field_caps`)
 - Nested query features that depend on schema availability
-- Public package installs (once enabled)
+- Linux secure storage when a Secret Service-compatible keyring is missing or locked
 
 Best-effort means we will investigate issues but cannot guarantee behavior across all deployments.
 
@@ -45,6 +45,7 @@ If you find a security issue, report it through the process documented in `SECUR
 - Critical security reports: acknowledge within 3 business days.
 - Non-security issues: response cadence depends on maintainer availability.
 - Release notes and shipped version history are published through GitHub Releases and npm, not through committed changelog updates in the repository.
+- Questions about the current shipped version should be answered from npm or GitHub Releases, not from the `package.json` version committed in git.
 
 ## Out of Scope
 

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@havesomecode/kibana-mcp-server",
-  "version": "0.1.0",
+  "version": "1.1.0",
   "license": "MIT",
   "description": "Read-only MCP server for Kibana-backed log investigation and schema-aware querying",
-  "homepage": "https://github.com/Zacaria/kibana-mcp-server",
+  "homepage": "https://havesomecode.github.io/kibana-mcp-server/",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Zacaria/kibana-mcp-server.git"
+    "url": "git+https://github.com/Havesomecode/kibana-mcp-server.git"
   },
   "type": "module",
   "main": "dist/src/mcp_entry.js",
@@ -56,10 +56,10 @@
     "@biomejs/biome": "^1.8.3",
     "@commitlint/cli": "^20.1.0",
     "@commitlint/config-conventional": "^20.0.0",
-    "@types/node": "^24.0.0",
     "semantic-release": "^25.0.1",
+    "@types/node": "^25.5.2",
     "tsx": "^4.0.0",
     "typescript": "^5.7.0",
-    "vitest": "^3.0.0"
+    "vitest": "^4.1.3"
   }
 }

package/plugins/kibana-log-investigation/.codex-plugin/plugin.json

@@ -3,11 +3,11 @@
   "version": "0.1.0",
   "description": "Install the local Kibana log investigation MCP from this repository.",
   "author": {
-    "name": "Zacaria",
-    "url": "https://github.com/Zacaria"
+    "name": "Havesomecode",
+    "url": "https://github.com/Havesomecode"
   },
-  "homepage": "https://github.com/Zacaria/kibana-mcp-server",
-  "repository": "https://github.com/Zacaria/kibana-mcp-server",
+  "homepage": "https://havesomecode.github.io/kibana-mcp-server/",
+  "repository": "https://github.com/Havesomecode/kibana-mcp-server",
   "license": "MIT",
   "keywords": ["kibana", "logs", "mcp", "investigation", "codex"],
   "skills": "./skills/",
@@ -15,13 +15,13 @@
   "interface": {
     "displayName": "Kibana Log Investigation",
     "shortDescription": "Local Kibana log investigation MCP for Codex",
-    "longDescription": "Install a local stdio MCP server from this repository so Codex can discover sources, inspect schema metadata, and query Kibana-backed logs without additional hosting. This repo is the primary distribution contract today; public distribution is planned once artifact verification is stable.",
-    "developerName": "Zacaria",
+    "longDescription": "Install the repo-local Kibana investigation MCP for Codex, or use the published package directly. The homepage covers the public install story, while this plugin keeps the local repository workflow first-class.",
+    "developerName": "Havesomecode",
     "category": "Productivity",
     "capabilities": ["Interactive", "Read", "Write"],
-    "websiteURL": "https://github.com/Zacaria/kibana-mcp-server",
-    "privacyPolicyURL": "https://github.com/Zacaria/kibana-mcp-server",
-    "termsOfServiceURL": "https://github.com/Zacaria/kibana-mcp-server",
+    "websiteURL": "https://havesomecode.github.io/kibana-mcp-server/",
+    "privacyPolicyURL": "https://github.com/Havesomecode/kibana-mcp-server",
+    "termsOfServiceURL": "https://github.com/Havesomecode/kibana-mcp-server",
     "defaultPrompt": [
       "Install the Kibana Log Investigation plugin from this repo, bootstrap Node.js if needed, and configure it for my Kibana environment.",
       "Use the Kibana Log Investigation plugin to inspect log sources and query a time window."