npm - @ieranama/discomcp - Versions diffs - 0.5.0 → 0.5.1 - Mend

@ieranama/discomcp 0.5.0 → 0.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/README.md CHANGED Viewed

@@ -2,7 +2,9 @@
 # 🪩 DiscoMCP
-**Turn an unknown MCP into a reusable, workspace-aware operational skill for AI agents.**
+**Your agent, meet your tools.**
+Give any AI agent a real, safe understanding of the tools it connects to — in one command.
 [![CI](https://github.com/ieranama/discomcp/actions/workflows/ci.yml/badge.svg)](https://github.com/ieranama/discomcp/actions/workflows/ci.yml)
 [![Release](https://img.shields.io/github/v/release/ieranama/discomcp?label=release)](https://github.com/ieranama/discomcp/releases)
@@ -11,189 +13,64 @@
 </div>
-No agent should walk onto the dance floor blind — DiscoMCP checks the room, learns the moves, and only then cuts in.
-DiscoMCP turns an unknown Model Context Protocol (MCP) connection into a reusable, workspace-aware operational skill for AI agents.
-It connects to a target MCP, collects its declared capabilities and configured documentation, safely explores only permitted read or harmless computation paths, and produces a profile with a workspace-specific `SKILL.md`.
-DiscoMCP makes your agent be the one in the room you would like to dance with — not the one who shows up, starts flailing at every button on the mixing desk, and calls it improvisation. It learns the playlist first, asks before it touches the decks, and never, ever pulls the fire alarm to see what happens.
+Agents are great at code. They get lost inside your tools — they don't know which of a hundred actions matter, how your data connects, or what's safe to touch. So they guess, or they freeze.
-## Why DiscoMCP
+DiscoMCP fixes that. Point it at any MCP server and it hands your agent a ready-made skill: what the server does, how it's actually used, and exactly what's safe — learned by looking, and **without ever changing a thing**.
-An MCP tool catalogue alone does not explain how a particular user's accessible workspace is organized or which tool sequence solves a real task. DiscoMCP keeps the target catalogue internal, records evidence for every important claim, and generates an operational model that agents can use without guessing.
+## Why teams use it
-The result answers questions such as:
-- What does this MCP expose, and what platform or data source does it represent?
-- Which tools are safe to call during discovery, and which require explicit confirmation later?
-- Which structures, fields, identifiers, and relationships were actually observed?
-- What workflow should an agent follow to answer a user request safely?
-- What remains uncertain?
-## Safety Contract
+| | |
+| --- | --- |
+| 🧭 **Agents that know their way around** | Your agent gets a map of the tool instead of guessing — the sequences that answer real questions, and how one result leads to the next. |
+| 🔒 **Read-only, guaranteed** | Exploring can never write. It runs a step only when it can *prove* that step is a read. Nothing is deleted or modified while it learns. |
+| ⚡ **One command, zero setup** | A single 8 MB binary. No runtime, no toolchain — `npx` and you're running. |
+| 🧩 **Works with any MCP server** | Local or hosted. The same tool profiles your CRM, your data warehouse, or any API behind MCP. |
-DiscoMCP separates model reasoning from deterministic runtime control. A reasoning backend may propose a probe, but the runtime validates the target tool, JSON arguments, identifier provenance, policy, budgets, response limits, and redaction before any call is made.
+## Read-only, guaranteed
-During profiling, the runtime never automatically executes tools classified as:
+This is the part that lets you actually turn an agent loose on a real system.
-- mutation
-- external side effect
-- destructive
-- administrative
-- arbitrary execution
-- unknown risk
+DiscoMCP explores behind a **default-deny gate**: it runs an action only when it can prove that action is a read. A safe lookup runs. Anything that could write, change, or delete — even if a tool *claims* it's harmless — is refused. Secrets are stripped from everything it saves.
-Sensitive reads are additionally constrained by the configured privacy policy. Secrets are redacted before logs, persistence, generated artifacts, and reasoning-provider requests.
+So your agent can learn your production tools without you holding your breath.
-## Quick Start
+## Get started
-Run it with no install — `npx` fetches the right prebuilt binary for your platform:
+**1. Run it** — no install needed:
 ```bash
 npx @ieranama/discomcp --help
 ```
-Or install the binary once (no Rust toolchain required):
-```bash
-curl --proto '=https' --tlsv1.2 -LsSf https://github.com/ieranama/discomcp/releases/latest/download/discomcp-installer.sh | sh
-```
-(Windows: `powershell -ExecutionPolicy Bypass -c "irm https://github.com/ieranama/discomcp/releases/latest/download/discomcp-installer.ps1 | iex"`. All platform archives are on the [releases page](https://github.com/ieranama/discomcp/releases).)
-Point a config at any MCP server you can run locally over stdio — this is the whole file:
+**2. Point it at a server** — the whole config is a few lines:
 ```toml
 [targets.example]
 transport = "stdio"
 command = "npx"
-args = ["-y", "example-mcp"]
-[profiles]
-privacy_mode = "balanced"
+args = ["-y", "some-mcp-server"]
 ```
-Then add DiscoMCP to your agent as a regular MCP server. Your agent is the brain; the DiscoMCP runtime enforces every safety check:
+**3. Hand it to your agent** and let it explore:
 ```bash
-claude mcp add discomcp -- discomcp serve --config ./discomcp.toml
+discomcp serve --config ./discomcp.toml
 ```
-The agent drives profiling through six tools — `list_targets`, `lookup_target`, `inspect_target`, `execute_probe`, `finalize_profile`, `generate_skill` — and the runtime validates every probe (risk class, argument schema, identifier provenance, budgets, redaction) before anything touches the target. Mutating, destructive, and administrative tools are always rejected during onboarding. `lookup_target` tells the agent whether a fresh skill already exists for the target's current catalogue, so exploration only runs when something actually changed.
-No agent connected? The standalone CLI does the same job with a configured reasoning backend (see [examples/config.toml](examples/config.toml)):
+Your agent does the exploring; DiscoMCP keeps it safe and writes the skill. The result lands in `.discomcp/profiles/<server>/SKILL.md` — ready to drop into your agent.
-```bash
-discomcp profile example \
-  --config ./examples/config.toml \
-  --mode standard \
-  --goal "Understand this MCP, safely explore my accessible workspace, and generate an operational skill"
-```
-Profiles are written below `.discomcp/profiles/<target-id>/`. The canonical outputs are:
-- `capability-profile.json`
-- `workspace-model.json`
-- `operational-model.json`
-`SKILL.md` and `AGENTS.md` are generated exports of that canonical state.
-## Configuration
-Start with [examples/config.toml](examples/config.toml). Targets are owned by DiscoMCP; it does not inherit servers from another agent host automatically. `stdio` launches a real MCP subprocess and communicates using newline-delimited JSON-RPC.
-```toml
-[targets.example]
-transport = "stdio"
-command = "npx"
-args = ["-y", "example-mcp"]
-docs = ["./docs/example-mcp.md"]
-[targets.example.env]
-EXAMPLE_API_KEY = "${EXAMPLE_API_KEY}"
-[reasoning]
-routing = "single"
-everyday_backend = "primary"
-[reasoning.backends.primary]
-type = "command"
-command = "some-agent-cli"
-args = ["exec", "--model", "{model}"]
-model = "your-configured-model"
-input = "stdin_json"
-output = "stdout_json"
-```
+## Under the hood
-The command receives one serialized `ReasoningRequest` on stdin and must emit either a `ReasoningResponse` JSON object or the raw JSON value for its `output` on stdout. No target credentials or unredacted MCP response are interpolated into the command line.
-Environment interpolation fails clearly when a required variable is missing and never prints the resolved secret. Do not commit credentials, profile output containing sensitive workspace material, or `.env` files.
-## Evidence
-Every material claim in a generated profile carries one of these statuses:
-| Status | Meaning |
-| --- | --- |
-| `declared` | Exposed directly through MCP metadata, schemas, or annotations. |
-| `documented` | Found in configured or MCP-exposed documentation. |
-| `observed` | Confirmed by a successful permitted MCP call. |
-| `inferred` | Reasoned from declarations, documentation, and observations. |
-| `user_defined` | Explicitly supplied by the user. |
-| `unknown` | Insufficient evidence. |
-| `contradicted` | Relevant sources disagree. |
-Inferences include their confidence, supporting evidence, source references, and contradictions. DiscoMCP does not present an inferred relationship as an observed fact.
-## Development
-Want to contribute, or run an unreleased change? Build from source instead of installing the binary.
-Prerequisites: Rust stable with `rustfmt` and `clippy`, and `cargo-audit` for the full local quality gate.
-```bash
-git clone https://github.com/ieranama/discomcp.git
-cd discomcp
-cargo run -p discomcp -- profile example --config ./examples/config.toml --mode standard --goal "..."
-```
-Run the local quality gate before opening a pull request:
-```bash
-cargo fmt --check
-cargo clippy --all-targets --all-features -- -D warnings
-cargo test --all
-cargo audit
-```
-Install the audit tool once if needed:
-```bash
-cargo install cargo-audit --locked
-```
-The repository includes a generic collection-oriented mock MCP fixture so tests do not require credentials or external services.
-## Documentation
+Built in Rust: the model does the thinking, a small deterministic core enforces every safety check. Every claim in a generated skill is tagged with how it was known — declared, documented, observed, or inferred — so an agent never mistakes a guess for a fact.
 - [Architecture](docs/ARCHITECTURE.md)
 - [Threat model](docs/THREAT_MODEL.md)
 - [Extension guide](docs/EXTENDING.md)
-- [Contributing](CONTRIBUTING.md)
-- [Security policy](SECURITY.md)
-## Contributing
-See [CONTRIBUTING.md](CONTRIBUTING.md). By participating, you agree to follow the [Code of Conduct](CODE_OF_CONDUCT.md).
+- [Configuration example](examples/config.toml)
+- [Contributing](CONTRIBUTING.md) · [Security policy](SECURITY.md)
 ## License
-Licensed under either of
-- [Apache License, Version 2.0](LICENSE-APACHE)
-- [MIT License](LICENSE-MIT)
-at your option.
+Licensed under either of [Apache License, Version 2.0](LICENSE-APACHE) or [MIT License](LICENSE-MIT) at your option.
 Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in DiscoMCP by you, as defined in the Apache-2.0 license, shall be dual-licensed as above, without any additional terms or conditions.

package/npm-shrinkwrap.json CHANGED Viewed

@@ -19,7 +19,7 @@
       "hasInstallScript": true,
       "license": "MIT OR Apache-2.0",
       "name": "@ieranama/discomcp",
-      "version": "0.5.0"
+      "version": "0.5.1"
     },
     "node_modules/detect-libc": {
       "engines": {
@@ -48,5 +48,5 @@
     }
   },
   "requires": true,
-  "version": "0.5.0"
+  "version": "0.5.1"
 }

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/ieranama/discomcp/releases/download/v0.5.0"
+    "https://github.com/ieranama/discomcp/releases/download/v0.5.1"
   ],
   "bin": {
     "discomcp": "run-discomcp.js"
@@ -80,7 +80,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.5.0",
+  "version": "0.5.1",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"