@layerporter/image-optimizer-mcp 0.1.1 → 0.1.2

package/README.md

@@ -1,123 +1,116 @@
 # LayerPorter Website Image Optimizer MCP
 
-Technical candidate for page-aware website image optimization through Model Context Protocol.
+Public MCP server for website image analysis and safe image optimization.
 
-## Status
+## Install
 
-Version 0.1.0 is already public on npm. Version 0.1.1 is the security-hardening release candidate. Official MCP Registry publication is a separate step and is not implied by npm publication.
-
-Registry identity:
+```bash
+npx -y @layerporter/image-optimizer-mcp@latest
+```
 
 - npm package: `@layerporter/image-optimizer-mcp`
 - MCP server: `com.layerporter/website-image-optimizer`
 - transport: `stdio`
 - Node.js: `>=22.12.0`
+- repository: `https://github.com/OlegStrateg/lp-site`
+- product page: `https://layerporter.com/mcp/website-image-optimizer/`
 
-The npm package carries `mcpName: com.layerporter/website-image-optimizer`, matching `server.json`, so the Official MCP Registry can verify package ownership after the package exists publicly on npm.
+The npm package is publicly available. Official MCP Registry publication is a separate distribution step and is not implied by npm publication.
 
-## Tools
+## What it does
 
-The current server registers seven bounded tools:
+The server registers seven bounded tools:
 
-- `analyze_page_images`
-- `optimize_image`
-- `generate_responsive_variants`
-- `compare_image_versions`
-- `optimize_page_images`
-- `analyze_url_images`
-- `optimize_url_images`
+- `analyze_page_images` — analyze caller-provided page/image facts;
+- `optimize_image` — optimize one image;
+- `generate_responsive_variants` — generate resized image variants without upscaling;
+- `compare_image_versions` — compare image versions;
+- `optimize_page_images` — optimize a bounded set of page images;
+- `analyze_url_images` — inspect images referenced by static HTML at a public URL;
+- `optimize_url_images` — fetch and optimize a bounded set of raster images referenced by static HTML.
 
-The first five operate on caller-provided image data or normalized page facts. The two URL tools perform bounded read-only HTTP(S) fetching through a dedicated SSRF-protected network boundary. URL mode is intentionally a fast static-HTML mode: it does not claim browser-rendered size, `currentSrc`, LCP, CSS-background discovery, or JavaScript-driven lazy content.
+Accepted optimized binaries are returned through temporary MCP `resource_link` values and read separately with `resources/read`.
 
-Accepted optimized binaries are exposed as temporary MCP `resource_link` values and are read separately with `resources/read`; they are not embedded in the initial tool text response.
+## Input and output boundary
 
-## Runtime
+Untrusted image input is fail-closed:
 
-- Node.js `>=22.12.0`
-- MCP v2 server package
-- stdio transport
-- image processing through the shared image core / Sharp / libvips
+- accepted input decoders: JPEG, PNG, WebP;
+- blocked input decoders: HEIF/AVIF, TIFF, GIF, SVG, and unknown formats;
+- AVIF remains available as an output format.
 
-## Local source setup
+The optimizer applies bounded transformations and does not upscale images.
 
-A source checkout does not contain the generated `src/image-core` copy. Sync it explicitly before MCP tests or direct server startup:
+## URL mode limitations
 
-```bash
-cd packages/image-core
-npm install --no-audit --no-fund
-npm test
-
-cd ../image-optimizer-mcp
-npm install --ignore-scripts --no-audit --no-fund
-npm run release:preflight
-npm run sync:core
-npm test
-node src/server.js
-```
+URL mode is intentionally a fast static-HTML path. It does **not** claim to provide a browser-rendered audit.
 
-The last command starts the stdio MCP server and waits for a client connection. `npm pack` also runs `sync:core` through `prepack`; source setup and packed-artifact setup are verified separately.
+It does not discover or measure:
 
-## Installation
+- browser-selected `currentSrc`;
+- real LCP;
+- CSS background images;
+- JavaScript-injected or lazy-loaded content that is absent from the fetched HTML;
+- production page write/apply behavior.
 
-```bash
-npx -y @layerporter/image-optimizer-mcp
-```
-
-## License
+Use it for bounded static discovery and optimization, not as a replacement for a browser runtime or Core Web Vitals measurement.
 
-This package is proprietary LayerPorter software. The official unmodified package may be downloaded, installed, and used under the terms in `LICENSE`. Copying beyond technically necessary installation/runtime copies, modification, derivative works, repackaging, redistribution, sublicensing, resale, and unauthorized hosting are prohibited.
+## Safety
 
-The software is licensed, not sold. Third-party dependencies remain governed by their own licenses.
+The package:
 
-## Release model
-
-The first npm version is a bootstrap release: npm staged publishing and Trusted Publisher configuration require the package to already exist. The first public package therefore must be published by the package owner with npm account 2FA. After that bootstrap, GitHub Actions Trusted Publishing can be configured for `.github/workflows/image-mcp-release.yml`, and later versions can use the staged OIDC release path.
-
-Official MCP Registry publication happens only **after** the matching npm version is publicly available. The Registry namespace uses ownership of `layerporter.com` and the server name `com.layerporter/website-image-optimizer`.
-
-## Safety boundary
+- performs public HTTP(S) reads only through the two URL tools;
+- blocks unsafe URL schemes, credentials, localhost/private/link-local/reserved destinations, unsafe DNS answers, and redirects to prohibited addresses;
+- caps page bytes, image bytes, total accepted bytes, redirects, image count, timeouts, and concurrency;
+- writes accepted output only to an isolated temporary artifact store;
+- does not execute shell commands;
+- does not perform arbitrary filesystem writes;
+- does not modify a website or production environment.
 
-The current MCP package:
+Temporary artifacts are process-local and ephemeral. The default TTL is 30 minutes; cleanup is performed during store operations/disposal rather than at an exact wall-clock instant.
 
-- accepts untrusted image input only as JPEG, PNG, or WebP; HEIF/AVIF, TIFF, GIF, SVG and unknown input decoders are fail-closed blocked; AVIF remains available as an output format;
+## Quick usage examples
 
-- performs bounded public HTTP(S) reads only through `analyze_url_images` and `optimize_url_images`;
-- blocks unsafe URL schemes, URL credentials, localhost/private/link-local/reserved targets, unsafe DNS answers and redirects to prohibited addresses;
-- caps page bytes, per-image bytes, accepted total image bytes, redirects, image count, timeouts and concurrency;
-- writes accepted image artifacts only to its isolated temporary artifact store;
-- does not perform arbitrary filesystem write/delete/rename operations;
-- does not execute shell commands;
-- does not write to a website or production environment.
+After connecting the MCP server to a compatible client, requests can be framed around the task:
 
-Local transform tools consume caller-provided image buffers or normalized page facts. URL tools are read-only open-world operations. Hard safety comes from implementation controls, not only from MCP metadata.
+- “Analyze the images referenced by this page URL.”
+- “Optimize this JPEG for web delivery without upscaling.”
+- “Generate responsive variants for this image.”
+- “Compare these two image versions and report the byte difference.”
 
-Temporary artifacts are process-local and ephemeral. Their default TTL is 30 minutes, but cleanup occurs during store operations/disposal rather than as a guarantee of physical deletion at an exact wall-clock instant. `resources/read` returns the resource blob separately; whether a client places that blob into model context is client-specific.
+Client-specific MCP configuration differs by product, so use the MCP client’s current documentation for its exact server configuration format.
 
 ## Verification
 
-Release preparation verifies:
+The release process verifies:
 
-- package/server identity consistency;
-- proprietary license metadata and packaged `LICENSE` presence;
+- package/server identity and version consistency;
 - image-core and MCP tests;
 - packed npm artifact metadata;
 - clean installation of the packed tarball;
-- real stdio startup and client handshake from the packed artifact;
-- `tools/list`, transform calls, temporary `resource_link` and `resources/read`;
-- Official MCP Registry `server.json` validation;
-- full LayerPorter Astro build in the integrated repository tree.
+- stdio startup and MCP client handshake;
+- exactly seven expected tools;
+- real tool calls;
+- temporary `resource_link` and `resources/read`;
+- public-package source equivalence after publication.
+
+## License
+
+This package is proprietary LayerPorter software. The official unmodified package may be downloaded, installed, and used under the terms in `LICENSE`.
 
-## Public documentation
+Copying beyond technically necessary installation/runtime copies, modification, derivative works, repackaging, redistribution, sublicensing, resale, and unauthorized hosting are prohibited. Third-party dependencies remain governed by their own licenses.
 
-Canonical product pages after site release:
+## Links
 
-- `https://layerporter.com/mcp/website-image-optimizer/`
-- `https://layerporter.com/docs/mcp/website-image-optimizer/`
+- Product: `https://layerporter.com/mcp/website-image-optimizer/`
+- Documentation: `https://layerporter.com/docs/mcp/website-image-optimizer/`
+- Repository: `https://github.com/OlegStrateg/lp-site`
+- Issues: `https://github.com/OlegStrateg/lp-site/issues`
 
-## Not yet included
+## Not included
 
-- confirmed Official MCP Registry publication;
-- hosted endpoint;
+- Official MCP Registry publication;
+- hosted remote endpoint;
 - full browser crawler/runtime metrics collection;
-- production apply/write tool;
-- universal performance or quality claims.
+- production apply/write tools;
+- universal performance, quality, or Core Web Vitals guarantees.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@layerporter/image-optimizer-mcp",
-  "version": "0.1.1",
-  "description": "Page-aware MCP server for deterministic website image analysis and safe optimization.",
+  "version": "0.1.2",
+  "description": "MCP server for website image analysis, safe compression, resizing, responsive variants, and WebP/AVIF output.",
   "mcpName": "com.layerporter/website-image-optimizer",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",

package/server.json

@@ -2,19 +2,19 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "com.layerporter/website-image-optimizer",
   "title": "LayerPorter Website Image Optimizer",
-  "description": "Page-aware website image analysis and safe optimization MCP server.",
+  "description": "Website image analysis and safe optimization for compression, resizing, and responsive variants.",
   "websiteUrl": "https://layerporter.com/mcp/website-image-optimizer/",
   "repository": {
     "url": "https://github.com/OlegStrateg/lp-site",
     "source": "github",
     "subfolder": "packages/image-optimizer-mcp"
   },
-  "version": "0.1.1",
+  "version": "0.1.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@layerporter/image-optimizer-mcp",
-      "version": "0.1.1",
+      "version": "0.1.2",
       "transport": {
         "type": "stdio"
       }