@mrfentmen/bundlephobia-mcp 1.0.0 → 1.0.2

package/README.md

@@ -18,3 +18,22 @@ node dist/index.js
 ```
 
 Data comes from the public Bundlephobia API.
+
+<!-- paywall -->
+## Premium tools
+
+These tools need a license key:
+
+* `package_comparison`
+* `package_metadata`
+
+Buy a key at https://mcp-marketplace.io/server/io-github-mrfentmen-bundlephobia-mcp and set it in your MCP client config:
+
+```json
+"env": { "MCP_LICENSE_KEY": "mcp_live_..." }
+```
+
+The key is checked against MCP Marketplace, cached for 24 hours, and keeps
+working offline once one check has succeeded. Every other tool on this server
+stays free.
+<!-- /paywall -->

package/dist/api.js

@@ -28,3 +28,99 @@ export async function size(args) {
         `Dependencies: ${s('dependencyCount')} | Has side effects: ${s('hasJSModule') ? 'module' : s('hasJSNext') ? 'next' : 'no'}`,
     ].filter(Boolean).join('\n');
 }
+// ---- muxA tools:
+function fmtBytes(n) {
+    const v = Number(n);
+    if (!Number.isFinite(v) || v <= 0)
+        return 'n/a';
+    if (v >= 1024 * 1024)
+        return `${(v / 1024 / 1024).toFixed(2)} MB`;
+    if (v >= 1024)
+        return `${(v / 1024).toFixed(1)} KB`;
+    return `${v} B`;
+}
+function clean(value) {
+    return value != null ? String(value) : '';
+}
+async function sizeOf(name) {
+    const res = await fetch(`${BASE}?package=${encodeURIComponent(name)}`, {
+        headers: { 'User-Agent': 'mrfentmen-bundlephobia-mcp/1.0', Accept: 'application/json' },
+        // bundlephobia builds each package on demand and is slow on a cold package
+        signal: AbortSignal.timeout(45000),
+    });
+    if (res.status === 404)
+        throw new Error(`Bundlephobia has no package named ${name}`);
+    if (!res.ok)
+        throw new Error(`Bundlephobia returned ${res.status} for ${name}`);
+    return (await res.json());
+}
+export async function packageComparison(args) {
+    const raw = (args.packages ?? '').trim();
+    if (!raw)
+        return 'Provide two or more packages, comma separated, e.g. "react@18.3.1,lodash@4.17.21".';
+    const names = raw
+        .split(',')
+        .map((n) => n.trim())
+        .filter(Boolean)
+        .slice(0, 10);
+    if (names.length < 2)
+        return 'Give at least two packages to compare.';
+    const rows = [];
+    for (const name of names) {
+        try {
+            rows.push({ asked: name, data: await sizeOf(name) });
+        }
+        catch (e) {
+            rows.push({ asked: name, data: null, error: e instanceof Error ? e.message : String(e) });
+        }
+    }
+    const good = rows.filter((r) => r.data);
+    if (!good.length)
+        return `Bundlephobia returned nothing usable for ${names.join(', ')}.`;
+    const ranked = good
+        .map((r) => ({ asked: r.asked, data: r.data }))
+        .sort((a, b) => (Number(b.data.gzip) || 0) - (Number(a.data.gzip) || 0));
+    const biggest = Number(ranked[0].data.gzip) || 0;
+    const lines = [
+        `Bundle comparison across ${names.length} package(s), largest gzipped first:`,
+        ...ranked.map((r, i) => {
+            const d = r.data;
+            const gzip = Number(d.gzip) || 0;
+            const ratio = biggest ? ((gzip / biggest) * 100).toFixed(0) : '?';
+            return `${i + 1}. ${clean(d.name)}@${clean(d.version)} | gzip ${fmtBytes(d.gzip)} (${ratio}% of the largest)` +
+                ` | minified ${fmtBytes(d.size)} | ${clean(d.dependencyCount)} dependencies`;
+        }),
+    ];
+    const failed = rows.filter((r) => !r.data);
+    if (failed.length) {
+        lines.push(`Could not measure: ${failed.map((r) => `${r.asked} (${r.error})`).join('; ')}`);
+    }
+    return lines.join('\n');
+}
+export async function packageMetadata(args) {
+    const name = (args.name ?? '').trim();
+    if (!name)
+        return 'Provide a package name.';
+    const d = await sizeOf(name);
+    const assets = (d.assets ?? []);
+    const lines = [
+        `${clean(d.name)}${d.scoped ? ' (scoped)' : ''}@${clean(d.version)}`,
+        clean(d.description) ? `Description: ${clean(d.description).slice(0, 300)}` : 'Description: not reported',
+        `Repository: ${clean(d.repository) || 'not reported'}`,
+        `Module type: ${d.isModuleType ? 'ESM' : 'CommonJS'}`,
+        `Side effects: ${typeof d.hasSideEffects === 'boolean' ? (d.hasSideEffects ? 'yes, importing it can run code' : 'no, safe to tree shake') : 'not reported'}`,
+        `Tree shaking: ${d.hasJSNext ? 'has a Next.js specific build' : d.hasJSModule ? 'has a JS module build' : 'not reported'}`,
+        `Dependencies: ${clean(d.dependencyCount)} (Bundlephobia counts the package's own dependency graph)`,
+        `Total size: ${fmtBytes(d.size)} minified, ${fmtBytes(d.gzip)} gzipped`,
+    ];
+    if (assets.length) {
+        lines.push(`Assets (${assets.length}):`);
+        for (const a of assets) {
+            lines.push(`  ${clean(a.name) || 'unnamed'} [${clean(a.type) || 'type not reported'}] ${fmtBytes(a.size)} minified, ${fmtBytes(a.gzip)} gzipped`);
+        }
+    }
+    else {
+        lines.push('Assets: Bundlephobia returned none for this package.');
+    }
+    return lines.join('\n');
+}

package/dist/license.js

@@ -0,0 +1,79 @@
+// Premium tools on this server need a license key bought from MCP Marketplace.
+// Buyers put the key in their MCP client config as MCP_LICENSE_KEY. Every tool
+// that is not listed in PREMIUM keeps working without a key.
+const SLUG = "bundlephobia-mcp";
+// Tools that need a key. Everything else is free.
+const PREMIUM = new Set([
+    "package_comparison",
+    "package_metadata",
+]);
+const BUY_URL = `https://mcp-marketplace.io/server/io-github-mrfentmen-${SLUG}`;
+// The license check calls the marketplace's verify endpoint directly instead of
+// using @mcp_marketplace/license. That SDK sends no `apikey` header, so every
+// check it makes is rejected by Supabase before it reaches the function. The
+// publishable key below is public by design - it ships in mcp-marketplace.io's
+// own JavaScript and only ever reaches their licence check.
+const DEFAULT_VERIFY_URL = "https://virupvwhtkpkjsiskckg.supabase.co/functions/v1/verify-key";
+const PUBLISHABLE_KEY = "sb_publishable_BuqlW96Ke8C_zzJG-LQv1Q_YHi_r_4h";
+const OK_CACHE_MS = 60 * 60 * 1000;
+const BAD_CACHE_MS = 60 * 1000;
+const seen = new Map();
+const REASONS = {
+    missing_key: "no key is set",
+    invalid_format: "that key is not a valid MCP Marketplace key",
+    not_found: "that key was not found",
+    revoked: "that key has been revoked",
+    rotated: "that key was rotated, use your new one",
+    expired: "that key has expired, renew it",
+    rate_limited: "there were too many checks just now, try again shortly",
+    network_error: "the license server could not be reached",
+};
+function blocked(tool, reason) {
+    const why = REASONS[reason] ?? `the license server answered "${reason}"`;
+    return `"${tool}" needs a license key, but ${why}. ` +
+        `Set MCP_LICENSE_KEY in your MCP client config. Get a key: ${BUY_URL}`;
+}
+async function verify(key) {
+    const res = await fetch(process.env.MCP_LICENSE_VERIFY_URL || DEFAULT_VERIFY_URL, {
+        method: "POST",
+        headers: {
+            apikey: PUBLISHABLE_KEY,
+            Authorization: `Bearer ${PUBLISHABLE_KEY}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ key, slug: SLUG }),
+        // an unusable key answers 400 with a JSON body, so read the body either way
+        signal: AbortSignal.timeout(15000),
+    });
+    const data = (await res.json());
+    if (typeof data?.valid !== "boolean")
+        return { valid: false, reason: "unexpected_response" };
+    return data;
+}
+/**
+ * Returns null when the caller may run the tool, or a short message telling
+ * them how to get a key.
+ *
+ * A good key is remembered for an hour, so a busy session does not hit the
+ * license server on every call and keeps working through a brief outage.
+ */
+export async function premiumRequired(tool) {
+    if (!PREMIUM.has(tool))
+        return null;
+    const key = process.env.MCP_LICENSE_KEY;
+    if (!key)
+        return blocked(tool, "missing_key");
+    const hit = seen.get(key);
+    if (hit && Date.now() - hit.at < (hit.valid ? OK_CACHE_MS : BAD_CACHE_MS)) {
+        return hit.valid ? null : blocked(tool, hit.reason ?? "invalid");
+    }
+    let result;
+    try {
+        result = await verify(key);
+    }
+    catch {
+        result = { valid: false, reason: "network_error" };
+    }
+    seen.set(key, { ...result, at: Date.now() });
+    return result.valid ? null : blocked(tool, result.reason ?? "invalid");
+}

package/dist/server.js

@@ -1,6 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
-import { size } from "./api.js";
+import { size, packageComparison, packageMetadata } from "./api.js";
+import { premiumRequired } from "./license.js";
 const text = (value) => ({ content: [{ type: "text", text: value }] });
 const textError = (t) => ({ content: [{ type: "text", text: t }], isError: true });
 const READ_ONLY = { readOnlyHint: true, openWorldHint: true };
@@ -20,5 +21,41 @@ export function createServer() {
             return textError(error(e));
         }
     });
+    server.registerTool("package_comparison", {
+        title: "Package comparison",
+        description: "Measure several npm packages side by side and rank them by gzipped size.",
+        inputSchema: z.object({ packages: z.string().describe("Comma separated packages, e.g. react@18.3.1,lodash@4.17.21.") }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        // ---- paywall: package_comparison ----
+        const paywallMessage = await premiumRequired("package_comparison");
+        if (paywallMessage)
+            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // ---- paywall: end ----
+        try {
+            return text(await packageComparison(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
+    server.registerTool("package_metadata", {
+        title: "Package metadata",
+        description: "Description, repository, module type, side effects and the per-asset size breakdown of one package.",
+        inputSchema: z.object({ name: z.string().describe("Package name, optionally with a version.") }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        // ---- paywall: package_metadata ----
+        const paywallMessage = await premiumRequired("package_metadata");
+        if (paywallMessage)
+            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // ---- paywall: end ----
+        try {
+            return text(await packageMetadata(args));
+        }
+        catch (e) {
+            return textError(error(e));
+        }
+    });
     return server;
 }

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0",
+  "version": "1.0.2",
   "type": "module",
   "repository": {
     "type": "git",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/mrfentmen/bundlephobia-mcp",
     "source": "github"
   },
-  "version": "1.0.0",
+  "version": "1.0.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@mrfentmen/bundlephobia-mcp",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "transport": {
         "type": "stdio"
       }