@jclvsh/xmark 0.6.1 → 0.7.0

package/README.md

@@ -32,6 +32,19 @@ Optionally override the API host (default is `https://api.xmark.dev`):
 export XMARK_API_URL=https://api.xmark.dev
 ```
 
+## Hosted endpoint
+
+Clients that connect to a remote MCP server can use the hosted endpoint instead of this package:
+
+```
+https://api.xmark.dev/mcp
+```
+
+- Transport: MCP streamable HTTP, `POST` only.
+- Registry: listed in the [official MCP registry](https://registry.modelcontextprotocol.io) as `io.github.JCLVSH/xmark`.
+- Auth: `Authorization: Bearer nt_live_...` (the same API key; its scopes apply). `initialize` and `tools/list` answer without a key, so a client can read the tool list before signing up; calling a tool needs the key.
+- Tools: the class of each hosted tool is listed at https://www.xmark.dev/docs#mcp-hosted.
+
 ## Tools exposed via MCP
 
 | Tool                        | What it does                                                       |
@@ -46,6 +59,7 @@ export XMARK_API_URL=https://api.xmark.dev
 | `get_conversation_messages` | A conversation's message history.                                  |
 | `delete_conversation`       | Permanently delete a conversation.                                 |
 | `get_usage`                 | Plan + quota usage (chat this month, syncs today, bookmark count). |
+| `get_affiliate`             | Affiliate status, link, sign-ups, and commission totals (stdio only). |
 
 ## CLI commands
 
@@ -60,6 +74,7 @@ xmark conversations
 xmark messages <conversation-id>
 xmark delete-conversation <conversation-id>
 xmark usage
+xmark affiliate
 ```
 
 Global flags: `--format table` renders paginated lists as a table (default is `json`).

package/dist/commands/usage.js

@@ -12,4 +12,16 @@ export function registerUsageCommands(program, client) {
             handleError(error);
         }
     });
+    program
+        .command("affiliate")
+        .description("Your affiliate status, link, sign-ups, and commission totals")
+        .action(async () => {
+        try {
+            const result = await client.get("/affiliate");
+            formatOutput(result, getFormat(program.opts()));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
 }

package/dist/hosted-transport.d.ts

@@ -8,3 +8,22 @@ import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
  * opens an event stream that never ends).
  */
 export declare function serveStatelessMcp(server: McpServer, request: Request): Promise<Response>;
+/**
+ * True when a JSON-RPC payload (one message or a batch) only asks who the server is and which
+ * tools it has. A host may answer these without a key, so an agent or a directory can see what
+ * the server does before signing up. Every message must be on the list: one tool call in a
+ * batch makes the whole payload need a key.
+ */
+export declare function isDiscoveryPayload(payload: unknown): boolean;
+/**
+ * True when the request's body is a discovery payload. Reads a clone, so the request can still
+ * be served afterwards, and stops at MAX_DISCOVERY_BODY_BYTES: a larger body, or a chunked one
+ * with no Content-Length, is never buffered whole.
+ */
+export declare function isDiscoveryRequest(request: Request): Promise<boolean>;
+/**
+ * The API client for a keyless discovery server: it has no key, so every use throws. Listing
+ * tools never touches the client; a tool call that reached this server would fail here, before
+ * any REST request.
+ */
+export declare function keylessClient<Client extends object>(): Client;

package/dist/hosted-transport.js

@@ -15,3 +15,70 @@ export async function serveStatelessMcp(server, request) {
     await server.connect(transport);
     return transport.handleRequest(request);
 }
+/** JSON-RPC methods that describe the server and change nothing. */
+const DISCOVERY_METHODS = new Set(["initialize", "notifications/initialized", "ping", "tools/list"]);
+/** A handshake is three messages; a longer keyless batch is not a handshake. */
+const MAX_DISCOVERY_BATCH = 10;
+/**
+ * True when a JSON-RPC payload (one message or a batch) only asks who the server is and which
+ * tools it has. A host may answer these without a key, so an agent or a directory can see what
+ * the server does before signing up. Every message must be on the list: one tool call in a
+ * batch makes the whole payload need a key.
+ */
+export function isDiscoveryPayload(payload) {
+    const messages = Array.isArray(payload) ? payload : [payload];
+    if (messages.length === 0 || messages.length > MAX_DISCOVERY_BATCH)
+        return false;
+    return messages.every((message) => {
+        if (typeof message !== "object" || message === null)
+            return false;
+        const method = message.method;
+        return typeof method === "string" && DISCOVERY_METHODS.has(method);
+    });
+}
+/** A handshake fits in a few hundred bytes; a keyless body past this is not one. */
+const MAX_DISCOVERY_BODY_BYTES = 16_384;
+/**
+ * True when the request's body is a discovery payload. Reads a clone, so the request can still
+ * be served afterwards, and stops at MAX_DISCOVERY_BODY_BYTES: a larger body, or a chunked one
+ * with no Content-Length, is never buffered whole.
+ */
+export async function isDiscoveryRequest(request) {
+    const stream = request.clone().body;
+    if (!stream)
+        return false;
+    const reader = stream.getReader();
+    const bytes = new Uint8Array(MAX_DISCOVERY_BODY_BYTES);
+    let size = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (size + value.byteLength > MAX_DISCOVERY_BODY_BYTES) {
+                // Not awaited: cancelling one side of a cloned body only settles once the other
+                // side is cancelled too, and the caller is about to answer without reading it.
+                void reader.cancel().catch(() => undefined);
+                return false;
+            }
+            bytes.set(value, size);
+            size += value.byteLength;
+        }
+        return isDiscoveryPayload(JSON.parse(new TextDecoder().decode(bytes.subarray(0, size))));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The API client for a keyless discovery server: it has no key, so every use throws. Listing
+ * tools never touches the client; a tool call that reached this server would fail here, before
+ * any REST request.
+ */
+export function keylessClient() {
+    return new Proxy({}, {
+        get(_target, property) {
+            throw new Error(`an api key is required (client.${String(property)} was used without one)`);
+        },
+    });
+}

package/dist/hosted.d.ts

@@ -8,3 +8,12 @@ export interface HostedMcpOptions {
 }
 /** One hosted MCP request: a per-request client and server over the stateless transport. */
 export declare function handleHostedMcpRequest(request: Request, options: HostedMcpOptions): Promise<Response>;
+/**
+ * One keyless discovery request (initialize, tools/list): the same hosted server and tool list,
+ * built on a client that cannot make a REST call. The host checks the request with
+ * isDiscoveryRequest first; anything else needs a key and goes to handleHostedMcpRequest.
+ */
+export declare function handleHostedMcpDiscovery(request: Request, options: {
+    version: string;
+}): Promise<Response>;
+export { isDiscoveryPayload, isDiscoveryRequest } from "./hosted-transport.js";

package/dist/hosted.js

@@ -1,5 +1,5 @@
 import { XmarkClient } from "./client.js";
-import { serveStatelessMcp } from "./hosted-transport.js";
+import { keylessClient, serveStatelessMcp } from "./hosted-transport.js";
 import { createXmarkServer } from "./server.js";
 /** One hosted MCP request: a per-request client and server over the stateless transport. */
 export function handleHostedMcpRequest(request, options) {
@@ -7,3 +7,17 @@ export function handleHostedMcpRequest(request, options) {
     const server = createXmarkServer({ client, version: options.version, profile: "hosted" });
     return serveStatelessMcp(server, request);
 }
+/**
+ * One keyless discovery request (initialize, tools/list): the same hosted server and tool list,
+ * built on a client that cannot make a REST call. The host checks the request with
+ * isDiscoveryRequest first; anything else needs a key and goes to handleHostedMcpRequest.
+ */
+export function handleHostedMcpDiscovery(request, options) {
+    const server = createXmarkServer({
+        client: keylessClient(),
+        version: options.version,
+        profile: "hosted",
+    });
+    return serveStatelessMcp(server, request);
+}
+export { isDiscoveryPayload, isDiscoveryRequest } from "./hosted-transport.js";

package/dist/tool-policy.js

@@ -5,6 +5,11 @@ const hosted = (category, toolClass) => ({
     hosted: true,
     category,
 });
+const localOnly = (category, toolClass) => ({
+    class: toolClass,
+    hosted: false,
+    category,
+});
 export const TOOL_POLICY = {
     // bookmarks
     list_bookmarks: hosted("bookmarks", "read"),
@@ -22,6 +27,9 @@ export const TOOL_POLICY = {
     // usage
     get_usage: hosted("usage", "read"),
     get_changelog: hosted("usage", "read"),
+    // stdio only for now: the hosted tool set is pinned to what is under review at Meta
+    // (__tests__/server.test.ts). Read-only; applying and payouts stay in the app and with the admin.
+    get_affiliate: localOnly("usage", "read"),
 };
 export const toolPolicy = (name) => toolPolicyFor(TOOL_POLICY, name);
 export const isToolEnabled = (name, profile) => isToolEnabledIn(TOOL_POLICY, name, profile);

package/dist/tools/usage.js

@@ -20,4 +20,13 @@ export function registerUsageTools(server, client) {
             return formatMcpError(error);
         }
     });
+    server.tool("get_affiliate", 'the user\'s affiliate status ("none" if they have not applied), code and link, sign-up count, commission totals in US cents (in the hold, payable, paid out), and the program terms. read-only; applying is done in the app at /settings/affiliate.', {}, async () => {
+        try {
+            const result = await client.get("/affiliate");
+            return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+        }
+        catch (error) {
+            return formatMcpError(error);
+        }
+    });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@jclvsh/xmark",
-	"version": "0.6.1",
+	"version": "0.7.0",
 	"mcpName": "io.github.JCLVSH/xmark",
 	"description": "MCP server and CLI for the xmark API — chat with your X bookmarks from inside Claude Code, Cursor, or any MCP client.",
 	"type": "module",