@mcpskillsio/server 2.1.1 → 2.3.0

package/.netlify/netlify.toml

@@ -0,0 +1,332 @@
+functionsDirectory = "/Users/michaelbrowne/Desktop/mcpskills/mcp-server/netlify/functions"
+functionsDirectoryOrigin = "config-v1"
+redirectsOrigin = "config"
+plugins = []
+headers = []
+
+[functions]
+
+[functions.nightly-crawl]
+schedule = "0 2 * * *"
+
+[functions.daily-scan]
+schedule = "0 8 * * *"
+
+[functions.weekly-digest]
+schedule = "0 18 * * 0"
+
+[functions.monthly-recap]
+schedule = "0 14 1-5 * *"
+
+[functions."*"]
+included_files = ["lib/fonts/**", "data/**"]
+external_node_modules = ["satori", "@resvg/resvg-js", "@netlify/blobs"]
+node_bundler = "esbuild"
+
+[build]
+publish = "/Users/michaelbrowne/Desktop/mcpskills/mcp-server/public"
+publishOrigin = "config"
+base = "/Users/michaelbrowne/Desktop/mcpskills/mcp-server"
+functions = "/Users/michaelbrowne/Desktop/mcpskills/mcp-server/netlify/functions"
+
+[build.environment]
+
+[build.processing]
+
+[build.processing.css]
+
+[build.processing.html]
+
+[build.processing.images]
+
+[build.processing.js]
+
+[build.services]
+
+[[redirects]]
+from = "/blog/state-of-ai-skill-security"
+to = "/blog/state-of-ai-skill-security.html"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/blog/clawhavoc-missing-trust-layer"
+to = "/blog/clawhavoc-missing-trust-layer.html"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/blog/how-to-check-ai-skill-safe"
+to = "/blog/how-to-check-ai-skill-safe.html"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/blog/score-without-github-repo"
+to = "/blog/score-without-github-repo.html"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/privacy"
+to = "/privacy.html"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/terms"
+to = "/terms.html"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/badge/*"
+to = "/.netlify/functions/badge/:splat"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/score/*"
+to = "/.netlify/functions/score-page/:splat"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/digest/rss.xml"
+to = "/.netlify/functions/digest-rss"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/digest/*"
+to = "/.netlify/functions/digest-page/:splat"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/digest"
+to = "/.netlify/functions/digest-page"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/certified"
+to = "/.netlify/functions/certified-wall"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/api/limit-capture"
+to = "/.netlify/functions/limit-capture"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/api/trending"
+to = "/.netlify/functions/trending"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/trending"
+to = "/.netlify/functions/trending"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/sitemap.xml"
+to = "/.netlify/functions/sitemap"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/data/latest.json"
+to = "/.netlify/functions/data-export"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/data/latest.csv"
+to = "/.netlify/functions/data-export"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/methodology"
+to = "/methodology.html"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/roadmap"
+to = "/roadmap.html"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/certify"
+to = "/certify.html"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/api/certify"
+to = "/.netlify/functions/certify"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/api/webhook"
+to = "/.netlify/functions/webhook"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]
+
+[[redirects]]
+from = "/api/unlock"
+to = "/.netlify/functions/unlock"
+status = 200.0
+force = false
+
+[redirects.query]
+
+[redirects.conditions]
+
+[redirects.headers]

package/index.js

@@ -15,6 +15,7 @@
  *   - check_watched: Re-scan all watched repos
  *   - batch_check: Check up to 5 repos in one call (Pro)
  *   - auto_gate: "Should I install this?" → boolean + reason
+ *   - build_stack: "What tools do I need?" → vetted stack from live trust data
  *
  * Free tier returns compact agent response.
  * Full reports require MCPSKILLS_API_KEY env var.
@@ -30,6 +31,44 @@ import {
 
 const API_BASE = "https://mcpskills.io/.netlify/functions";
 const PACKAGES_URL = "https://mcpskills.io/.netlify/functions/packages";
+const DATA_URL = "https://mcpskills.io/data/latest.json";
+
+// --- Stack Builder: category definitions + keyword matching ---
+// Mirrors data/registry.json categories but kept inline so the MCP server
+// is fully self-contained (no fetch to a private data file).
+const STACK_CATEGORIES = {
+  'ai-sdk':         { name: 'AI SDK & LLM Tools',       keywords: ['ai', 'llm', 'gpt', 'claude', 'anthropic', 'openai', 'chat', 'agent', 'embedding', 'langchain'] },
+  'mcp-server':     { name: 'MCP Servers & Protocol',   keywords: ['mcp', 'model-context-protocol', 'mcp-server', 'tool-server', 'skill'] },
+  'database':       { name: 'Database & ORM',           keywords: ['database', 'db', 'orm', 'sql', 'postgres', 'mysql', 'sqlite', 'prisma', 'drizzle', 'supabase', 'mongo'] },
+  'auth':           { name: 'Authentication & Security', keywords: ['auth', 'authentication', 'login', 'oauth', 'jwt', 'session', 'nextauth', 'clerk', 'passport'] },
+  'payments':       { name: 'Payments & Billing',       keywords: ['payment', 'stripe', 'billing', 'checkout', 'subscription', 'commerce', 'lemon'] },
+  'ui':             { name: 'UI Components & Design',   keywords: ['ui', 'component', 'design', 'shadcn', 'radix', 'tailwind', 'css', 'frontend'] },
+  'email':          { name: 'Email & Messaging',        keywords: ['email', 'smtp', 'mail', 'resend', 'sendgrid', 'notification', 'messaging'] },
+  'testing':        { name: 'Testing & Quality',        keywords: ['test', 'testing', 'jest', 'vitest', 'playwright', 'cypress', 'e2e', 'unit-test'] },
+  'devops':         { name: 'DevOps & Infrastructure',  keywords: ['deploy', 'docker', 'ci', 'cd', 'infrastructure', 'kubernetes', 'monitoring', 'netlify', 'vercel'] },
+  'web-framework':  { name: 'Web Frameworks',           keywords: ['next', 'nextjs', 'express', 'fastify', 'hono', 'remix', 'nuxt', 'svelte', 'framework', 'server'] },
+  'validation':     { name: 'Validation & Schema',      keywords: ['validation', 'schema', 'zod', 'joi', 'yup', 'typebox', 'form'] },
+  'search':         { name: 'Search & RAG',             keywords: ['search', 'vector', 'rag', 'embedding', 'pinecone', 'chromadb', 'semantic', 'retrieval'] },
+  'scraping':       { name: 'Web Scraping & Data',      keywords: ['scrape', 'scraping', 'crawl', 'puppeteer', 'playwright', 'cheerio', 'data-extraction'] },
+  'file-system':    { name: 'File System & Storage',    keywords: ['file', 'storage', 's3', 'upload', 'filesystem', 'blob', 'bucket'] },
+};
+
+const STACK_CROSS_CATEGORY = {
+  'ai-sdk': ['mcp-server', 'database', 'search'],
+  'mcp-server': ['ai-sdk', 'auth', 'database'],
+  'database': ['auth', 'validation', 'web-framework'],
+  'auth': ['database', 'payments', 'web-framework'],
+  'payments': ['auth', 'email', 'web-framework'],
+  'ui': ['web-framework', 'testing', 'validation'],
+  'email': ['payments', 'auth'],
+  'testing': ['devops', 'ai-sdk'],
+  'devops': ['testing', 'database'],
+  'web-framework': ['database', 'auth', 'ui'],
+  'validation': ['database', 'ai-sdk'],
+  'search': ['ai-sdk', 'database'],
+  'scraping': ['database', 'ai-sdk'],
+  'file-system': ['database', 'devops'],
+};
 
 // --- API Client ---
 
@@ -115,6 +154,55 @@ function formatRecommendations(recs) {
 
 // --- Agent Response Formatting ---
 
+function formatPartialResult(data) {
+  const lines = [
+    `# Limited Trust Score: ${data.package || 'Unknown Package'}`,
+    "",
+    `⚠️ **Limited Score — No Source Repo Found**`,
+    `Score based on npm registry metadata only (${data.signalCount}/${data.totalPossibleSignals} signals).`,
+    "",
+    `**Score:** ${data.composite}/10`,
+    `**Tier:** ${formatTier(data.tier)}`,
+    "",
+    "## Dimensions (limited)",
+    formatDimensions(data.dimensions),
+    "",
+    "## Signals (npm metadata only)",
+  ];
+
+  const signalLabels = {
+    publish_recency: "Publish Recency",
+    publish_cadence: "Publish Cadence",
+    download_adoption: "Download Adoption",
+    maintainer_count: "Maintainer Count",
+    package_age: "Package Age",
+    dependency_count: "Dependency Count",
+    license_clarity: "License Clarity",
+  };
+
+  for (const [key, val] of Object.entries(data.signals || {})) {
+    const label = signalLabels[key] || key;
+    const v = typeof val === 'number' && !isNaN(val) ? val : 0;
+    const bar = "█".repeat(Math.round(v)) + "░".repeat(10 - Math.round(v));
+    lines.push(`  ${bar} ${v}/10  ${label}`);
+  }
+
+  lines.push(
+    "",
+    `⚠️ ${data.limitedReason}`,
+    "",
+    `📦 ${data.meta?.versions || '?'} versions | 👥 ${data.meta?.maintainerCount || '?'} maintainers | 📄 ${data.meta?.license || 'Unknown'}`,
+    `📥 ${(data.meta?.npmDownloads || 0).toLocaleString()} downloads/month`,
+  );
+
+  if (data.meta?.homepage) {
+    lines.push(`🔗 ${data.meta.homepage}`);
+  }
+
+  lines.push("", `Scanned at: ${data.scannedAt}`, "Powered by mcpskills.io");
+  return lines.join("\n");
+}
+
 function formatAgentResponse(data) {
   // Compact agent response (from free tier API)
   const rec = data.recommendation || (data.safe ? 'install' : 'caution');
@@ -308,7 +396,7 @@ function formatSafetyResult(data) {
 const server = new Server(
   {
     name: "mcpskills",
-    version: "2.1.0",
+    version: "2.2.0",
   },
   {
     capabilities: {
@@ -324,14 +412,14 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "check_trust_score",
         description:
-          "Score any GitHub repo for trustworthiness. Returns a trust score (0-10) across 4 dimensions: Alive (maintained?), Legit (credible author?), Solid (secure?), Usable (good docs?). AI skills and MCP servers get enhanced scanning with 5 safety checks. Set MCPSKILLS_API_KEY env var for full 14-signal reports.",
+          "Score any AI skill, MCP server, or GitHub repo for trustworthiness. Returns a trust score (0-10) across 4 dimensions: Alive, Legit, Solid, Usable. Accepts: owner/repo, GitHub URL, npm package (npm:@scope/name or @scope/name), Smithery URL, or OpenClaw URL. AI skills get enhanced safety scanning. Set MCPSKILLS_API_KEY for full reports.",
         inputSchema: {
           type: "object",
           properties: {
             repo: {
               type: "string",
               description:
-                'GitHub repo in "owner/repo" format (e.g., "anthropics/anthropic-sdk-typescript")',
+                'Any of: "owner/repo", GitHub URL, "npm:@scope/package", "@scope/package", Smithery URL, or OpenClaw URL',
             },
           },
           required: ["repo"],
@@ -340,14 +428,14 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "scan_safety",
         description:
-          "Run a focused safety scan on an AI skill or MCP server repo. Checks for prompt injection, shell execution, network exfiltration, credential theft, and obfuscated payloads. Returns detailed findings with file locations. Only works on repos detected as AI skills.",
+          "Run a focused safety scan on an AI skill or MCP server. Checks for prompt injection, shell execution, network exfiltration, credential theft, and obfuscated payloads. Accepts any input format (owner/repo, npm package, Smithery URL, etc.).",
         inputSchema: {
           type: "object",
           properties: {
             repo: {
               type: "string",
               description:
-                'GitHub repo in "owner/repo" format (e.g., "modelcontextprotocol/servers")',
+                'Any of: "owner/repo", GitHub URL, "npm:@scope/package", Smithery URL, or OpenClaw URL',
             },
           },
           required: ["repo"],
@@ -371,13 +459,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "get_badge",
         description:
-          "Get a trust badge URL for any GitHub repo. Returns a shields.io-style SVG badge showing the trust score and tier. Embed in READMEs to show verified trust status. Badge auto-updates hourly.",
+          "Get a trust badge URL for any repo or package. Returns a shields.io-style SVG badge showing the trust score and tier. Embed in READMEs. Badge auto-updates hourly.",
         inputSchema: {
           type: "object",
           properties: {
             repo: {
               type: "string",
-              description: 'GitHub repo in "owner/repo" format',
+              description: 'Any of: "owner/repo", GitHub URL, "npm:@scope/package", or Smithery URL',
             },
           },
           required: ["repo"],
@@ -386,13 +474,13 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "watch_repo",
         description:
-          "Start monitoring a repo for trust score changes. You'll be alerted when a repo's score changes significantly (±0.3 points or tier change). Requires a paid API key.",
+          "Start monitoring a repo or package for trust score changes. Alerts when score changes significantly (±0.3 points or tier change). Requires a paid API key.",
         inputSchema: {
           type: "object",
           properties: {
             repo: {
               type: "string",
-              description: 'GitHub repo in "owner/repo" format',
+              description: 'Any of: "owner/repo", GitHub URL, "npm:@scope/package", or Smithery URL',
             },
             email: {
               type: "string",
@@ -420,14 +508,14 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "batch_check",
         description:
-          "Check up to 5 repos in one call. Returns a trust assessment for each repo. Requires a Pro API key (MCPSKILLS_API_KEY). Great for bulk-vetting dependencies.",
+          "Check up to 5 repos or packages in one call. Returns a trust assessment for each. Requires a Pro API key. Accepts any mix of formats (owner/repo, npm packages, registry URLs).",
         inputSchema: {
           type: "object",
           properties: {
             repos: {
               type: "array",
               items: { type: "string" },
-              description: 'Array of GitHub repos in "owner/repo" format (max 5)',
+              description: 'Array of repos/packages in any format (max 5). E.g., ["owner/repo", "npm:@scope/pkg", "https://smithery.ai/server/name"]',
             },
           },
           required: ["repos"],
@@ -436,18 +524,33 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       {
         name: "auto_gate",
         description:
-          'Should I install this? Returns a simple go/no-go decision with reasoning. The fastest way to check if a repo is safe to use. Returns { proceed: true/false, reason: "..." }.',
+          'Should I install this? Returns a simple go/no-go decision with reasoning. Accepts any format: owner/repo, npm package, Smithery URL, etc. Returns { proceed: true/false, reason: "..." }.',
         inputSchema: {
           type: "object",
           properties: {
             repo: {
               type: "string",
-              description: 'GitHub repo in "owner/repo" format',
+              description: 'Any of: "owner/repo", "npm:@scope/package", "@scope/package", Smithery URL, or OpenClaw URL',
             },
           },
           required: ["repo"],
         },
       },
+      {
+        name: "build_stack",
+        description:
+          'Recommend a vetted stack of trusted tools for a described task. Describe what you\'re building (e.g., "Next.js app with auth, payments, and AI chat") and get back a curated list of the highest-scoring repos in each relevant category, pre-scored and ready to install. Returns tool names, trust scores, tiers, and install hints. Use this instead of guessing which tools to recommend — every suggestion is backed by live trust data.',
+        inputSchema: {
+          type: "object",
+          properties: {
+            description: {
+              type: "string",
+              description: 'What the user wants to build or accomplish. Can be a full sentence ("I need a Next.js app with auth and Stripe") or just keywords ("auth payments database mcp")',
+            },
+          },
+          required: ["description"],
+        },
+      },
     ],
   };
 });
@@ -461,12 +564,12 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     switch (name) {
       case "check_trust_score": {
         const repo = args.repo;
-        if (!repo || !repo.includes("/")) {
+        if (!repo || repo.trim().length === 0) {
           return {
             content: [
               {
                 type: "text",
-                text: 'Invalid repo format. Use "owner/repo" (e.g., "anthropics/anthropic-sdk-typescript").',
+                text: 'Missing input. Accepts: "owner/repo", npm package, GitHub URL, Smithery URL, or OpenClaw URL.',
               },
             ],
             isError: true,
@@ -475,9 +578,12 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
         const data = await fetchScore(repo, apiKey);
 
-        // Determine if we got a full response or agent compact response
+        // Determine if we got a full response, partial, or agent compact response
         let formatted;
-        if (data.signals && data.dimensions) {
+        if (data.limited || data.mode === 'partial') {
+          // Partial score — no source repo found
+          formatted = formatPartialResult(data);
+        } else if (data.signals && data.dimensions) {
           // Full paid response
           formatted = formatFullResult(data);
         } else if (data.safe !== undefined) {
@@ -485,7 +591,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           formatted = formatAgentResponse(data);
         } else {
           // Human free response — format it for the agent
-          formatted = `${formatTier(data.tier)} ${data.repo} — ${data.composite}/10\n\nSet MCPSKILLS_API_KEY for full signal breakdown.`;
+          formatted = `${formatTier(data.tier)} ${data.repo || data.package} — ${data.composite}/10\n\nSet MCPSKILLS_API_KEY for full signal breakdown.`;
         }
 
         return { content: [{ type: "text", text: formatted }] };
@@ -493,12 +599,12 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
       case "scan_safety": {
         const repo = args.repo;
-        if (!repo || !repo.includes("/")) {
+        if (!repo || repo.trim().length === 0) {
           return {
             content: [
               {
                 type: "text",
-                text: 'Invalid repo format. Use "owner/repo".',
+                text: 'Missing input. Accepts: "owner/repo", npm package, GitHub URL, Smithery URL, or OpenClaw URL.',
               },
             ],
             isError: true,
@@ -555,9 +661,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
       case "get_badge": {
         const repo = args.repo;
-        if (!repo || !repo.includes("/")) {
+        if (!repo || repo.trim().length === 0) {
           return {
-            content: [{ type: "text", text: 'Invalid repo format. Use "owner/repo".' }],
+            content: [{ type: "text", text: 'Missing input. Accepts: "owner/repo", npm package, or registry URL.' }],
             isError: true,
           };
         }
@@ -593,9 +699,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       case "watch_repo": {
         const repo = args.repo;
         const email = args.email;
-        if (!repo || !repo.includes("/")) {
+        if (!repo || repo.trim().length === 0) {
           return {
-            content: [{ type: "text", text: 'Invalid repo format. Use "owner/repo".' }],
+            content: [{ type: "text", text: 'Missing input. Accepts: "owner/repo", npm package, or registry URL.' }],
             isError: true,
           };
         }
@@ -703,8 +809,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         const results = [];
 
         for (const repo of batch) {
-          if (!repo.includes("/")) {
-            results.push(`❌ ${repo} — invalid format`);
+          if (!repo || repo.trim().length === 0) {
+            results.push(`❌ (empty) — invalid input`);
             continue;
           }
           try {
@@ -740,9 +846,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
       case "auto_gate": {
         const repo = args.repo;
-        if (!repo || !repo.includes("/")) {
+        if (!repo || repo.trim().length === 0) {
           return {
-            content: [{ type: "text", text: 'Invalid repo format. Use "owner/repo".' }],
+            content: [{ type: "text", text: 'Missing input. Accepts: "owner/repo", npm package, or registry URL.' }],
             isError: true,
           };
         }
@@ -782,6 +888,198 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         return { content: [{ type: "text", text }] };
       }
 
+      case "build_stack": {
+        const desc = args.description;
+        if (!desc || desc.trim().length === 0) {
+          return {
+            content: [{ type: "text", text: 'Describe what you\'re building. E.g., "Next.js app with auth, payments, and AI chat" or just "auth payments database".' }],
+            isError: true,
+          };
+        }
+
+        // Parse description into lowercase tokens for keyword matching
+        const tokens = desc.toLowerCase()
+          .replace(/[^a-z0-9\s\-_.]/g, ' ')
+          .split(/\s+/)
+          .filter(t => t.length > 1);
+
+        // Match categories by keyword overlap
+        const matchedCategories = [];
+        for (const [catId, cat] of Object.entries(STACK_CATEGORIES)) {
+          const overlap = cat.keywords.filter(kw => tokens.some(t => t.includes(kw) || kw.includes(t)));
+          if (overlap.length > 0) {
+            matchedCategories.push({ id: catId, name: cat.name, matchCount: overlap.length, matchedKeywords: overlap });
+          }
+        }
+        // Sort by match strength
+        matchedCategories.sort((a, b) => b.matchCount - a.matchCount);
+
+        // If no direct matches, try to infer from common phrases
+        if (matchedCategories.length === 0) {
+          // Fallback: match any token that's a substring of any keyword
+          for (const [catId, cat] of Object.entries(STACK_CATEGORIES)) {
+            if (tokens.some(t => cat.name.toLowerCase().includes(t))) {
+              matchedCategories.push({ id: catId, name: cat.name, matchCount: 1, matchedKeywords: [] });
+            }
+          }
+        }
+
+        if (matchedCategories.length === 0) {
+          return {
+            content: [{
+              type: "text",
+              text: `Couldn't match "${desc}" to any tool categories. Try being more specific, e.g.:\n- "auth and payments for a Next.js app"\n- "database orm ai agent"\n- "mcp server testing devops"\n\nAvailable categories: ${Object.values(STACK_CATEGORIES).map(c => c.name).join(', ')}`,
+            }],
+          };
+        }
+
+        // Fetch the full scored dataset (CDN-cached, one call)
+        let allRepos = [];
+        try {
+          const res = await fetch(DATA_URL, {
+            headers: { 'Accept': 'application/json', 'User-Agent': 'mcpskills-mcp-server' },
+          });
+          if (res.ok) {
+            const data = await res.json();
+            allRepos = data.rows || [];
+          }
+        } catch {}
+
+        // Build keyword-to-category index for repo matching
+        // For each repo in the dataset, check if its description/key matches a category
+        function categorizeRepo(row) {
+          const searchText = `${row.key || ''} ${row.description || ''}`.toLowerCase();
+          const cats = [];
+          for (const [catId, cat] of Object.entries(STACK_CATEGORIES)) {
+            const hits = cat.keywords.filter(kw => searchText.includes(kw));
+            if (hits.length >= 1) cats.push(catId);
+          }
+          return cats;
+        }
+
+        // For each matched category, find the top-scored non-blocked repo
+        const stack = [];
+        const usedRepos = new Set();
+
+        for (const cat of matchedCategories) {
+          const candidates = allRepos
+            .filter(r => {
+              if (usedRepos.has(r.key)) return false;
+              if (r.tier === 'blocked') return false;
+              const repoCats = categorizeRepo(r);
+              return repoCats.includes(cat.id);
+            })
+            .sort((a, b) => (b.composite || 0) - (a.composite || 0));
+
+          const pick = candidates[0];
+          if (pick) {
+            usedRepos.add(pick.key);
+            stack.push({
+              category: cat.name,
+              categoryId: cat.id,
+              repo: pick.key,
+              score: pick.composite,
+              tier: pick.tier,
+              description: (pick.description || '').slice(0, 120),
+            });
+          } else {
+            stack.push({
+              category: cat.name,
+              categoryId: cat.id,
+              repo: null,
+              score: null,
+              tier: null,
+              description: 'No scored repos in this category yet',
+            });
+          }
+        }
+
+        // Add cross-category suggestions for any categories not already matched
+        const matchedIds = new Set(matchedCategories.map(c => c.id));
+        const suggestions = new Set();
+        for (const cat of matchedCategories) {
+          const adjacent = STACK_CROSS_CATEGORY[cat.id] || [];
+          for (const adjId of adjacent) {
+            if (!matchedIds.has(adjId) && !suggestions.has(adjId)) {
+              suggestions.add(adjId);
+            }
+          }
+        }
+
+        const suggestedTools = [];
+        for (const adjId of suggestions) {
+          const catDef = STACK_CATEGORIES[adjId];
+          if (!catDef) continue;
+          const candidates = allRepos
+            .filter(r => !usedRepos.has(r.key) && r.tier !== 'blocked' && categorizeRepo(r).includes(adjId))
+            .sort((a, b) => (b.composite || 0) - (a.composite || 0));
+          const pick = candidates[0];
+          if (pick) {
+            suggestedTools.push({
+              category: catDef.name,
+              repo: pick.key,
+              score: pick.composite,
+              tier: pick.tier,
+              reason: `Often used alongside ${matchedCategories[0]?.name || 'your stack'}`,
+            });
+          }
+          if (suggestedTools.length >= 3) break;
+        }
+
+        // Compute stack trust score
+        const scoredItems = stack.filter(s => typeof s.score === 'number');
+        const avgScore = scoredItems.length > 0
+          ? +(scoredItems.reduce((sum, s) => sum + s.score, 0) / scoredItems.length).toFixed(1)
+          : null;
+        const allVerified = scoredItems.every(s => s.tier === 'verified');
+
+        // Format output
+        const lines = [
+          `# Recommended Stack`,
+          ``,
+          `Based on: "${desc}"`,
+          `Stack Trust Score: ${avgScore ?? '—'}/10${allVerified ? ' ✅ All Verified' : ''}`,
+          ``,
+          `## Core Tools (${stack.length})`,
+        ];
+
+        for (const item of stack) {
+          if (item.repo) {
+            const icon = item.tier === 'verified' ? '✅' : item.tier === 'established' ? '🟡' : '⚪';
+            lines.push(`  ${icon} **${item.repo}** — ${item.score}/10 ${item.tier}`);
+            if (item.description) lines.push(`     ${item.description}`);
+            lines.push(`     Category: ${item.category}`);
+            lines.push(`     Score page: https://mcpskills.io/score/${encodeURI(item.repo)}`);
+          } else {
+            lines.push(`  ❓ **${item.category}** — no scored repos yet`);
+          }
+          lines.push('');
+        }
+
+        if (suggestedTools.length > 0) {
+          lines.push(`## You Might Also Need`);
+          for (const sug of suggestedTools) {
+            const icon = sug.tier === 'verified' ? '✅' : sug.tier === 'established' ? '🟡' : '⚪';
+            lines.push(`  ${icon} **${sug.repo}** — ${sug.score}/10 ${sug.tier}`);
+            lines.push(`     ${sug.reason}`);
+          }
+          lines.push('');
+        }
+
+        if (apiKey) {
+          lines.push(`---`);
+          lines.push(`Full signal breakdown available for each tool via check_trust_score.`);
+        } else {
+          lines.push(`---`);
+          lines.push(`Set MCPSKILLS_API_KEY for full 14-signal reports on each tool.`);
+          lines.push(`Get a key at https://mcpskills.io`);
+        }
+
+        lines.push('', 'Powered by mcpskills.io — every recommendation backed by live trust data.');
+
+        return { content: [{ type: "text", text: lines.join("\n") }] };
+      }
+
       default:
         return {
           content: [{ type: "text", text: `Unknown tool: ${name}` }],

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mcpskillsio/server",
-  "version": "2.1.1",
-  "description": "Trust-score any AI skill or MCP server from inside Claude Code, Cursor, or any MCP client. 14 signals, safety scanning, recommendations, badges, monitoring, batch checking, and auto-gate decisions.",
+  "version": "2.3.0",
+  "description": "Trust-score any AI skill or MCP server from inside Claude Code, Cursor, or any MCP client. Accepts GitHub repos, npm packages, Smithery URLs, and OpenClaw skills. 14 signals, safety scanning, recommendations, badges, monitoring, batch checking, auto-gate decisions, and stack building from live trust data.",
   "type": "module",
   "main": "index.js",
   "bin": {