@neus/mcp-server 1.0.2 → 1.1.0

package/README.md

@@ -1,40 +1,34 @@
 # @neus/mcp-server
 
-Model Context Protocol server for NEUS trust receipts, verification, and agent flows.
+Public **discovery metadata** for the hosted NEUS MCP at **`https://mcp.neus.network/mcp`**. This package does not ship a runtime server.
 
-## Prefer the hosted endpoint
+## Connect (recommended)
 
-For almost all integrations, connect to **`https://mcp.neus.network/mcp`** and follow **[MCP setup](https://docs.neus.network/mcp/setup)** (transport, auth, and access keys).
+```bash
+npx -y -p @neus/sdk neus setup
+npx -y -p @neus/sdk neus auth
+npx -y -p @neus/sdk neus doctor --live
+```
 
-This npm package ships **public discovery metadata** (for example `server.json`) for registries and installers. The hosted MCP server runs at **`https://mcp.neus.network/mcp`** — see the [MCP docs](https://docs.neus.network/mcp/overview) for setup and usage.
+Sign in with **`neus auth`** (OAuth). For servers and CI only, use a Profile access key:
 
-## Golden path (nine tools)
+```bash
+npx -y -p @neus/sdk neus setup --access-key <npk_...>
+```
 
-Models should **call neus_context first** every session, then follow the tool order your client needs:
+Install and auth guides: [docs.neus.network/mcp/setup](https://docs.neus.network/mcp/setup)
 
-| Tool | Role |
-| --- | --- |
-| `neus_context` | Session home — setup, verifier summaries, golden path |
-| `neus_verifiers_catalog` | Verifier metadata and JSON schemas |
-| `neus_proofs_check` | Eligibility only (does not create proofs) |
-| `neus_verify` | Start or continue verification when prerequisites already match |
-| `neus_verify_or_guide` | Guided flow when setup or consent is still missing |
-| `neus_proofs_get` | Read proof records, tags, and delegated context |
-| `neus_me` | Signed-in Profile when a personal access key is configured on the session |
-| `neus_agent_link` | Confirm agent identity and delegation readiness |
-| `neus_agent_create` | Prepare agent identity and delegation when setup is missing |
+## Registry manifest
 
-With a Profile access key on the MCP session, call **`neus_me`** and expect a successful status before relying on account-scoped behavior.
+`server.json` lists the twelve public MCP tools and the hosted endpoint for MCP registries and installers. OAuth discovery:
 
-## Auth and safety
+- `https://mcp.neus.network/.well-known/mcp.json`
+- `https://mcp.neus.network/.well-known/oauth-protected-resource`
 
-Use **`Authorization: Bearer`** with the **personal access key** from the NEUS app (Profile → Account). Do not embed secrets in public repos or client-side bundles. Inputs are validated at runtime.
+## Related package
 
-## Docs and support
-
-- **Product MCP guides:** [docs.neus.network/mcp](https://docs.neus.network/mcp/overview)  
-- **Issues (public):** [github.com/neus/network/issues](https://github.com/neus/network/issues)
+Use **`@neus/sdk`** for the JavaScript SDK, widgets, and the `neus` CLI (`neus setup`, `neus auth`, import/export).
 
 ## License
 
-Apache-2.0 (see the `license` field in `package.json`).
+Apache-2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neus/mcp-server",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "Public discovery metadata for the hosted NEUS MCP (streamable HTTP). Runtime is not shipped in this package.",
   "type": "module",
   "main": "./index.mjs",
@@ -9,19 +9,20 @@
   },
   "license": "Apache-2.0",
   "author": "NEUS Network <info@neus.network>",
-  "homepage": "https://neus.network",
+  "homepage": "https://docs.neus.network/mcp/overview",
   "bugs": {
     "url": "https://github.com/neus/network/issues"
   },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/neus/network.git",
-    "directory": "mcp"
+    "directory": "mcp/npm-dist"
   },
   "keywords": [
     "neus",
     "mcp",
     "model-context-protocol",
+    "oauth",
     "verification",
     "trust-receipts",
     "proofs",
@@ -34,5 +35,9 @@
   ],
   "engines": {
     "node": ">=20.0.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
   }
 }

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.neus/neus-mcp",
   "title": "NEUS MCP",
   "description": "NEUS hosted MCP: verifiers, proofs, verify flows, agents. Always call neus_context first.",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "repository": {
     "url": "https://github.com/neus/network",
     "source": "github"
@@ -11,7 +11,7 @@
   "websiteUrl": "https://docs.neus.network/mcp/overview",
   "icons": [
     {
-      "src": "https://neus.network/images/neus-brand-pack/neus-mark-128.png",
+      "src": "https://neus.network/images/neus-brand-pack/apple-touch-icon.png",
       "sizes": ["128x128"],
       "mimeType": "image/png"
     }
@@ -22,6 +22,10 @@
       "url": "https://mcp.neus.network/mcp"
     }
   ],
+  "authorization": {
+    "type": "oauth2",
+    "resourceMetadataUrl": "https://mcp.neus.network/.well-known/oauth-protected-resource"
+  },
   "capabilities": {
     "tools": {
       "supported": true,
@@ -34,7 +38,7 @@
   "tools": [
     {
       "name": "neus_context",
-      "description": "NEUS MCP session home: product summary, setup, access-key mode, verifier summaries, reuse-first workflow, tools, and safety rules. Always call first."
+      "description": "NEUS MCP session home: product summary, setup, OAuth sign-in, verifier summaries, reuse-first workflow, tools, and safety rules. Always call first."
     },
     {
       "name": "neus_verifiers_catalog",
@@ -54,11 +58,11 @@
     },
     {
       "name": "neus_proofs_get",
-      "description": "Reads proof records, tags, delegated agent reads, Profile summary fields, and live proof state. qHashes in the response are authoritative."
+      "description": "Reads proof records, tags, delegated agent reads, Profile summary fields, and live proof state. Use returned proof records as receipt references."
     },
     {
       "name": "neus_me",
-      "description": "Returns the signed-in NEUS Profile when a personal access key from Profile → Account is configured on this MCP session."
+      "description": "Returns the signed-in NEUS Profile when the MCP call has a NEUS session bearer or local Profile access key."
     },
     {
       "name": "neus_agent_link",
@@ -67,6 +71,18 @@
     {
       "name": "neus_agent_create",
       "description": "Prepares agent-identity and agent-delegation payloads (signatures and/or hostedVerifyUrl). Does not finalize receipts; confirm with neus_agent_link after signing. Skills/services fields are metadata only, not secrets."
+    },
+    {
+      "name": "neus_secret_create",
+      "description": "Store an env-style secret as an encrypted proof. Creates an ownership-basic proof with secret-storage tags. Values are AES-256-GCM sealed and never returned in plaintext via MCP."
+    },
+    {
+      "name": "neus_secret_list",
+      "description": "List env-style secret proofs for a wallet. Returns metadata only (qHash, alias, type, updatedAt). Values are never exposed."
+    },
+    {
+      "name": "neus_secret_revoke",
+      "description": "Revoke a stored secret proof by qHash. Removes the proof and cleans up any agent bindings. Requires authenticated ownership."
     }
   ],
   "license": "Apache-2.0",
@@ -79,50 +95,27 @@
     "neus",
     "mcp",
     "model-context-protocol",
+    "oauth",
     "verification",
     "trust-receipts",
     "proofs",
-    "delegation",
-    "identity",
-    "agents",
-    "profile",
-    "wallet",
-    "ai-agents",
-    "ethereum",
-    "solana",
-    "did",
-    "x402"
+    "agents"
   ],
   "examples": [
     {
       "title": "Bootstrap a session",
       "description": "Load the MCP session home plus verifier summaries.",
-      "prompt": "Call neus_context first, then follow the returned goldenPath. If Bearer is configured, call neus_me before any account-aware work."
+      "prompt": "Call neus_context first, then follow the returned recommendedFlow. If Bearer is configured (OAuth or Profile key), call neus_me before any account-aware work."
     },
     {
       "title": "Register an AI agent",
       "description": "Identity and delegation proofs for an agent wallet; confirm readiness before use.",
       "prompt": "Use neus_agent_link first when an agent wallet already exists. Use neus_agent_create only when setup is missing. If a hosted URL is returned, share it exactly, then call neus_agent_link after completion."
     },
-    {
-      "title": "Gate before a new verification",
-      "description": "Eligibility only—no new proof creation.",
-      "prompt": "Use neus_proofs_check for wallet 0x... and verifier IDs [\"ownership-basic\", \"proof-of-human\"]. Report only whether requirements are satisfied and which verifiers matched—do not start a new verification. Use qHash as the trust receipt reference; contentHash identifies proven content."
-    },
     {
       "title": "Reuse first, guide only when missing",
       "description": "Check existing trust before any browser handoff.",
-      "prompt": "Call neus_proofs_check for wallet 0x... and verifier IDs [\"ownership-basic\"]. If eligible, continue without hosted verify. If not eligible, call neus_verify_or_guide, share any returned hosted URL exactly, then call neus_proofs_get after completion and report the qHash from the proof record."
-    },
-    {
-      "title": "Tag-filtered proof inventory (delegated context)",
-      "description": "Filter proof reads by tags—for memory, skills, jobs—same tool as listing proofs.",
-      "prompt": "For wallet 0x..., call neus_proofs_get with tags=memory,skill and optional agentWallet only when delegated reads apply. Summarize proof titles, tags, and qHashes only—no invented records."
-    },
-    {
-      "title": "Instant verification with Profile access key",
-      "description": "When MCP carries your NEUS access key and the profile wallet matches, some instant verifiers may submit without a wallet signature.",
-      "prompt": "My NEUS personal access key is configured on this MCP connection and walletAddress 0x... matches my NEUS profile wallet. Call neus_context, then neus_me, then neus_proofs_check. If the existing receipt satisfies the request, stop. If not, call neus_verify only when prerequisites match; otherwise explain the next returned setup step."
+      "prompt": "Call neus_proofs_check for wallet 0x... and verifier IDs [\"ownership-basic\"]. If eligible, continue without hosted verify. If not eligible, call neus_verify_or_guide, share any returned hosted URL exactly, then call neus_proofs_get after completion."
     }
   ],
   "compatibility": {