@mcpskillsio/server 2.2.0 → 2.4.0

package/index.js

@@ -15,6 +15,7 @@
  *   - check_watched: Re-scan all watched repos
  *   - batch_check: Check up to 5 repos in one call (Pro)
  *   - auto_gate: "Should I install this?" → boolean + reason
+ *   - build_stack: "What tools do I need?" → vetted stack from live trust data
  *
  * Free tier returns compact agent response.
  * Full reports require MCPSKILLS_API_KEY env var.
@@ -30,6 +31,44 @@ import {
 
 const API_BASE = "https://mcpskills.io/.netlify/functions";
 const PACKAGES_URL = "https://mcpskills.io/.netlify/functions/packages";
+const DATA_URL = "https://mcpskills.io/data/latest.json";
+
+// --- Stack Builder: category definitions + keyword matching ---
+// Mirrors data/registry.json categories but kept inline so the MCP server
+// is fully self-contained (no fetch to a private data file).
+const STACK_CATEGORIES = {
+  'ai-sdk':         { name: 'AI SDK & LLM Tools',       keywords: ['ai', 'llm', 'gpt', 'claude', 'anthropic', 'openai', 'chat', 'agent', 'embedding', 'langchain'] },
+  'mcp-server':     { name: 'MCP Servers & Protocol',   keywords: ['mcp', 'model-context-protocol', 'mcp-server', 'tool-server', 'skill'] },
+  'database':       { name: 'Database & ORM',           keywords: ['database', 'db', 'orm', 'sql', 'postgres', 'mysql', 'sqlite', 'prisma', 'drizzle', 'supabase', 'mongo'] },
+  'auth':           { name: 'Authentication & Security', keywords: ['auth', 'authentication', 'login', 'oauth', 'jwt', 'session', 'nextauth', 'clerk', 'passport'] },
+  'payments':       { name: 'Payments & Billing',       keywords: ['payment', 'stripe', 'billing', 'checkout', 'subscription', 'commerce', 'lemon'] },
+  'ui':             { name: 'UI Components & Design',   keywords: ['ui', 'component', 'design', 'shadcn', 'radix', 'tailwind', 'css', 'frontend'] },
+  'email':          { name: 'Email & Messaging',        keywords: ['email', 'smtp', 'mail', 'resend', 'sendgrid', 'notification', 'messaging'] },
+  'testing':        { name: 'Testing & Quality',        keywords: ['test', 'testing', 'jest', 'vitest', 'playwright', 'cypress', 'e2e', 'unit-test'] },
+  'devops':         { name: 'DevOps & Infrastructure',  keywords: ['deploy', 'docker', 'ci', 'cd', 'infrastructure', 'kubernetes', 'monitoring', 'netlify', 'vercel'] },
+  'web-framework':  { name: 'Web Frameworks',           keywords: ['next', 'nextjs', 'express', 'fastify', 'hono', 'remix', 'nuxt', 'svelte', 'framework', 'server'] },
+  'validation':     { name: 'Validation & Schema',      keywords: ['validation', 'schema', 'zod', 'joi', 'yup', 'typebox', 'form'] },
+  'search':         { name: 'Search & RAG',             keywords: ['search', 'vector', 'rag', 'embedding', 'pinecone', 'chromadb', 'semantic', 'retrieval'] },
+  'scraping':       { name: 'Web Scraping & Data',      keywords: ['scrape', 'scraping', 'crawl', 'puppeteer', 'playwright', 'cheerio', 'data-extraction'] },
+  'file-system':    { name: 'File System & Storage',    keywords: ['file', 'storage', 's3', 'upload', 'filesystem', 'blob', 'bucket'] },
+};
+
+const STACK_CROSS_CATEGORY = {
+  'ai-sdk': ['mcp-server', 'database', 'search'],
+  'mcp-server': ['ai-sdk', 'auth', 'database'],
+  'database': ['auth', 'validation', 'web-framework'],
+  'auth': ['database', 'payments', 'web-framework'],
+  'payments': ['auth', 'email', 'web-framework'],
+  'ui': ['web-framework', 'testing', 'validation'],
+  'email': ['payments', 'auth'],
+  'testing': ['devops', 'ai-sdk'],
+  'devops': ['testing', 'database'],
+  'web-framework': ['database', 'auth', 'ui'],
+  'validation': ['database', 'ai-sdk'],
+  'search': ['ai-sdk', 'database'],
+  'scraping': ['database', 'ai-sdk'],
+  'file-system': ['database', 'devops'],
+};
 
 // --- API Client ---
 
@@ -357,7 +396,7 @@ function formatSafetyResult(data) {
 const server = new Server(
   {
     name: "mcpskills",
-    version: "2.2.0",
+    version: "2.4.0",
   },
   {
     capabilities: {
@@ -497,6 +536,21 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           required: ["repo"],
         },
       },
+      {
+        name: "build_stack",
+        description:
+          'Recommend a vetted stack of trusted tools for a described task. Describe what you\'re building (e.g., "Next.js app with auth, payments, and AI chat") and get back a curated list of the highest-scoring repos in each relevant category, pre-scored and ready to install. Returns tool names, trust scores, tiers, and install hints. Use this instead of guessing which tools to recommend — every suggestion is backed by live trust data.',
+        inputSchema: {
+          type: "object",
+          properties: {
+            description: {
+              type: "string",
+              description: 'What the user wants to build or accomplish. Can be a full sentence ("I need a Next.js app with auth and Stripe") or just keywords ("auth payments database mcp")',
+            },
+          },
+          required: ["description"],
+        },
+      },
     ],
   };
 });
@@ -834,6 +888,198 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         return { content: [{ type: "text", text }] };
       }
 
+      case "build_stack": {
+        const desc = args.description;
+        if (!desc || desc.trim().length === 0) {
+          return {
+            content: [{ type: "text", text: 'Describe what you\'re building. E.g., "Next.js app with auth, payments, and AI chat" or just "auth payments database".' }],
+            isError: true,
+          };
+        }
+
+        // Parse description into lowercase tokens for keyword matching
+        const tokens = desc.toLowerCase()
+          .replace(/[^a-z0-9\s\-_.]/g, ' ')
+          .split(/\s+/)
+          .filter(t => t.length > 1);
+
+        // Match categories by keyword overlap
+        const matchedCategories = [];
+        for (const [catId, cat] of Object.entries(STACK_CATEGORIES)) {
+          const overlap = cat.keywords.filter(kw => tokens.some(t => t.includes(kw) || kw.includes(t)));
+          if (overlap.length > 0) {
+            matchedCategories.push({ id: catId, name: cat.name, matchCount: overlap.length, matchedKeywords: overlap });
+          }
+        }
+        // Sort by match strength
+        matchedCategories.sort((a, b) => b.matchCount - a.matchCount);
+
+        // If no direct matches, try to infer from common phrases
+        if (matchedCategories.length === 0) {
+          // Fallback: match any token that's a substring of any keyword
+          for (const [catId, cat] of Object.entries(STACK_CATEGORIES)) {
+            if (tokens.some(t => cat.name.toLowerCase().includes(t))) {
+              matchedCategories.push({ id: catId, name: cat.name, matchCount: 1, matchedKeywords: [] });
+            }
+          }
+        }
+
+        if (matchedCategories.length === 0) {
+          return {
+            content: [{
+              type: "text",
+              text: `Couldn't match "${desc}" to any tool categories. Try being more specific, e.g.:\n- "auth and payments for a Next.js app"\n- "database orm ai agent"\n- "mcp server testing devops"\n\nAvailable categories: ${Object.values(STACK_CATEGORIES).map(c => c.name).join(', ')}`,
+            }],
+          };
+        }
+
+        // Fetch the full scored dataset (CDN-cached, one call)
+        let allRepos = [];
+        try {
+          const res = await fetch(DATA_URL, {
+            headers: { 'Accept': 'application/json', 'User-Agent': 'mcpskills-mcp-server' },
+          });
+          if (res.ok) {
+            const data = await res.json();
+            allRepos = data.rows || [];
+          }
+        } catch {}
+
+        // Build keyword-to-category index for repo matching
+        // For each repo in the dataset, check if its description/key matches a category
+        function categorizeRepo(row) {
+          const searchText = `${row.key || ''} ${row.description || ''}`.toLowerCase();
+          const cats = [];
+          for (const [catId, cat] of Object.entries(STACK_CATEGORIES)) {
+            const hits = cat.keywords.filter(kw => searchText.includes(kw));
+            if (hits.length >= 1) cats.push(catId);
+          }
+          return cats;
+        }
+
+        // For each matched category, find the top-scored non-blocked repo
+        const stack = [];
+        const usedRepos = new Set();
+
+        for (const cat of matchedCategories) {
+          const candidates = allRepos
+            .filter(r => {
+              if (usedRepos.has(r.key)) return false;
+              if (r.tier === 'blocked') return false;
+              const repoCats = categorizeRepo(r);
+              return repoCats.includes(cat.id);
+            })
+            .sort((a, b) => (b.composite || 0) - (a.composite || 0));
+
+          const pick = candidates[0];
+          if (pick) {
+            usedRepos.add(pick.key);
+            stack.push({
+              category: cat.name,
+              categoryId: cat.id,
+              repo: pick.key,
+              score: pick.composite,
+              tier: pick.tier,
+              description: (pick.description || '').slice(0, 120),
+            });
+          } else {
+            stack.push({
+              category: cat.name,
+              categoryId: cat.id,
+              repo: null,
+              score: null,
+              tier: null,
+              description: 'No scored repos in this category yet',
+            });
+          }
+        }
+
+        // Add cross-category suggestions for any categories not already matched
+        const matchedIds = new Set(matchedCategories.map(c => c.id));
+        const suggestions = new Set();
+        for (const cat of matchedCategories) {
+          const adjacent = STACK_CROSS_CATEGORY[cat.id] || [];
+          for (const adjId of adjacent) {
+            if (!matchedIds.has(adjId) && !suggestions.has(adjId)) {
+              suggestions.add(adjId);
+            }
+          }
+        }
+
+        const suggestedTools = [];
+        for (const adjId of suggestions) {
+          const catDef = STACK_CATEGORIES[adjId];
+          if (!catDef) continue;
+          const candidates = allRepos
+            .filter(r => !usedRepos.has(r.key) && r.tier !== 'blocked' && categorizeRepo(r).includes(adjId))
+            .sort((a, b) => (b.composite || 0) - (a.composite || 0));
+          const pick = candidates[0];
+          if (pick) {
+            suggestedTools.push({
+              category: catDef.name,
+              repo: pick.key,
+              score: pick.composite,
+              tier: pick.tier,
+              reason: `Often used alongside ${matchedCategories[0]?.name || 'your stack'}`,
+            });
+          }
+          if (suggestedTools.length >= 3) break;
+        }
+
+        // Compute stack trust score
+        const scoredItems = stack.filter(s => typeof s.score === 'number');
+        const avgScore = scoredItems.length > 0
+          ? +(scoredItems.reduce((sum, s) => sum + s.score, 0) / scoredItems.length).toFixed(1)
+          : null;
+        const allVerified = scoredItems.every(s => s.tier === 'verified');
+
+        // Format output
+        const lines = [
+          `# Recommended Stack`,
+          ``,
+          `Based on: "${desc}"`,
+          `Stack Trust Score: ${avgScore ?? '—'}/10${allVerified ? ' ✅ All Verified' : ''}`,
+          ``,
+          `## Core Tools (${stack.length})`,
+        ];
+
+        for (const item of stack) {
+          if (item.repo) {
+            const icon = item.tier === 'verified' ? '✅' : item.tier === 'established' ? '🟡' : '⚪';
+            lines.push(`  ${icon} **${item.repo}** — ${item.score}/10 ${item.tier}`);
+            if (item.description) lines.push(`     ${item.description}`);
+            lines.push(`     Category: ${item.category}`);
+            lines.push(`     Score page: https://mcpskills.io/score/${encodeURI(item.repo)}`);
+          } else {
+            lines.push(`  ❓ **${item.category}** — no scored repos yet`);
+          }
+          lines.push('');
+        }
+
+        if (suggestedTools.length > 0) {
+          lines.push(`## You Might Also Need`);
+          for (const sug of suggestedTools) {
+            const icon = sug.tier === 'verified' ? '✅' : sug.tier === 'established' ? '🟡' : '⚪';
+            lines.push(`  ${icon} **${sug.repo}** — ${sug.score}/10 ${sug.tier}`);
+            lines.push(`     ${sug.reason}`);
+          }
+          lines.push('');
+        }
+
+        if (apiKey) {
+          lines.push(`---`);
+          lines.push(`Full signal breakdown available for each tool via check_trust_score.`);
+        } else {
+          lines.push(`---`);
+          lines.push(`Set MCPSKILLS_API_KEY for full 14-signal reports on each tool.`);
+          lines.push(`Get a key at https://mcpskills.io`);
+        }
+
+        lines.push('', 'Powered by mcpskills.io — every recommendation backed by live trust data.');
+
+        return { content: [{ type: "text", text: lines.join("\n") }] };
+      }
+
       default:
         return {
           content: [{ type: "text", text: `Unknown tool: ${name}` }],

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mcpskillsio/server",
-  "version": "2.2.0",
-  "description": "Trust-score any AI skill or MCP server from inside Claude Code, Cursor, or any MCP client. Accepts GitHub repos, npm packages, Smithery URLs, and OpenClaw skills. 14 signals, safety scanning, recommendations, badges, monitoring, batch checking, and auto-gate decisions.",
+  "version": "2.4.0",
+  "description": "Trust-score any AI skill or MCP server from inside Claude Code, Cursor, or any MCP client. Accepts GitHub repos, npm packages, Smithery URLs, and OpenClaw skills. 15 signals (incl. OSV/KEV/EPSS vulnerability intelligence), safety scanning, OpenClaw frontmatter parsing + transparency scoring, recommendations, badges, monitoring, batch checking, auto-gate decisions, and stack building from live trust data.",
   "type": "module",
   "main": "index.js",
   "bin": {