@nyuchi/mzizi-mcp 0.5.0-beta.1 → 0.5.0-beta.2

package/README.md

@@ -40,7 +40,8 @@ connect. After that, reads are free and unlimited.
 ### stdio (local / offline)
 
 Run the stdio bin via npx — useful for Claude Code, Cursor, or any assistant that
-speaks stdio MCP:
+speaks stdio MCP. **It is zero-config** — the public mzizi registry URL + its
+publishable (anon, RLS read-only) key are baked in, so no `env` is needed:
 
 ```json
 {
@@ -48,18 +49,21 @@ speaks stdio MCP:
     "mzizi": {
       "type": "stdio",
       "command": "npx",
-      "args": ["-y", "@nyuchi/mzizi-mcp"],
-      "env": {
-        "SUPABASE_URL": "https://grjsboqkaywpwatvrzmy.supabase.co",
-        "SUPABASE_PUBLISHABLE_KEY": "<anon-key>"
-      }
+      "args": ["-y", "@nyuchi/mzizi-mcp"]
     }
   }
 }
 ```
 
-`SUPABASE_URL` defaults to the canonical mzizi project if omitted. Only
-`SUPABASE_PUBLISHABLE_KEY` is required for the stdio path.
+This is the **sanctioned headless path**: the hosted `mcp.mzizi.dev` endpoint
+sits behind an interactive, browser-only WorkOS signup gate that a headless agent
+(Claude Code, CI, an offline client) can't complete, whereas the stdio bin reads
+the same public registry directly with no login.
+
+To point the bin at a fork or a self-hosted mirror, override the defaults with
+`SUPABASE_URL` and `SUPABASE_PUBLISHABLE_KEY` (their `NEXT_PUBLIC_` equivalents
+are also accepted). Neither value is a secret — the publishable key only grants
+the anon role, which RLS restricts to read-only reads of the public registry.
 
 ---
 

package/dist/defaults.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Public connection defaults for the stdio bin.
+ *
+ * mzizi-mcp is a FREE, PUBLIC tool. The registry it serves
+ * (`component_documents` on the Mzizi Supabase project) is public,
+ * read-only, RLS-enforced anon access — exactly the audience Supabase's
+ * publishable/anon keys are designed for ("safe to ship in client apps").
+ *
+ * Baking the project URL + publishable key in as DEFAULTS makes
+ * `npx mzizi-mcp` work with zero configuration — which is what a headless
+ * agent (Claude Code, a CI job, a local MCP client) needs, since the hosted
+ * `mcp.mzizi.dev` endpoint sits behind an interactive, browser-only WorkOS
+ * signup gate that a headless session cannot complete.
+ *
+ * These are NOT secrets:
+ *   - the URL is a public project endpoint;
+ *   - the publishable key only grants the anon role, which RLS restricts to
+ *     read-only SELECT on the public registry tables.
+ * There is no service-role key here and no write path.
+ *
+ * Both are overridable via env (`SUPABASE_URL` / `SUPABASE_PUBLISHABLE_KEY`,
+ * or their `NEXT_PUBLIC_` equivalents) for anyone pointing the bin at a
+ * fork or a self-hosted mirror. If the publishable key is ever rotated,
+ * ship a new release (or set the env var) — the env override always wins.
+ */
+export declare const DEFAULT_SUPABASE_URL = "https://grjsboqkaywpwatvrzmy.supabase.co";
+/** Modern publishable key (sb_publishable_…) — anon role, RLS read-only. */
+export declare const DEFAULT_SUPABASE_PUBLISHABLE_KEY = "sb_publishable_90MsojNH3bKYBWIJFb3VpA_O_hbz-wQ";
+//# sourceMappingURL=defaults.d.ts.map

package/dist/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,eAAO,MAAM,oBAAoB,6CAA6C,CAAA;AAE9E,4EAA4E;AAC5E,eAAO,MAAM,gCAAgC,mDAAmD,CAAA"}

package/dist/defaults.js

@@ -0,0 +1,29 @@
+/**
+ * Public connection defaults for the stdio bin.
+ *
+ * mzizi-mcp is a FREE, PUBLIC tool. The registry it serves
+ * (`component_documents` on the Mzizi Supabase project) is public,
+ * read-only, RLS-enforced anon access — exactly the audience Supabase's
+ * publishable/anon keys are designed for ("safe to ship in client apps").
+ *
+ * Baking the project URL + publishable key in as DEFAULTS makes
+ * `npx mzizi-mcp` work with zero configuration — which is what a headless
+ * agent (Claude Code, a CI job, a local MCP client) needs, since the hosted
+ * `mcp.mzizi.dev` endpoint sits behind an interactive, browser-only WorkOS
+ * signup gate that a headless session cannot complete.
+ *
+ * These are NOT secrets:
+ *   - the URL is a public project endpoint;
+ *   - the publishable key only grants the anon role, which RLS restricts to
+ *     read-only SELECT on the public registry tables.
+ * There is no service-role key here and no write path.
+ *
+ * Both are overridable via env (`SUPABASE_URL` / `SUPABASE_PUBLISHABLE_KEY`,
+ * or their `NEXT_PUBLIC_` equivalents) for anyone pointing the bin at a
+ * fork or a self-hosted mirror. If the publishable key is ever rotated,
+ * ship a new release (or set the env var) — the env override always wins.
+ */
+export const DEFAULT_SUPABASE_URL = "https://grjsboqkaywpwatvrzmy.supabase.co";
+/** Modern publishable key (sb_publishable_…) — anon role, RLS read-only. */
+export const DEFAULT_SUPABASE_PUBLISHABLE_KEY = "sb_publishable_90MsojNH3bKYBWIJFb3VpA_O_hbz-wQ";
+//# sourceMappingURL=defaults.js.map

package/dist/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,0CAA0C,CAAA;AAE9E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gCAAgC,GAAG,gDAAgD,CAAA"}

package/dist/server.d.ts

@@ -23,7 +23,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { SupabaseClient } from "@supabase/supabase-js";
 import type { FundiToolContext } from "./fundi-client.js";
-export declare const MZIZI_MCP_VERSION = "0.5.0-beta.1";
+export declare const MZIZI_MCP_VERSION = "0.5.0-beta.2";
 /**
  * Build the Mzizi MCP server bound to a Supabase client with public read on
  * `mcp_tool_registry` / `component_documents` and EXECUTE on the backing RPCs.

package/dist/server.js

@@ -22,7 +22,7 @@
  */
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
-export const MZIZI_MCP_VERSION = "0.5.0-beta.1";
+export const MZIZI_MCP_VERSION = "0.5.0-beta.2";
 const str = (description) => ({ type: ["string", "null"], description });
 const reqStr = (description) => ({ type: "string", description });
 const int = (description) => ({ type: ["integer", "null"], description });

package/dist/stdio.d.ts

@@ -1,11 +1,20 @@
 #!/usr/bin/env node
 /**
- * stdio entry — for the MCP registry (`npx mzizi-mcp`).
+ * stdio entry — for the MCP registry (`npx mzizi-mcp`) and local MCP clients
+ * (Claude Code, etc.).
  *
  * Spawns the server over the stdio transport, using a long-lived Supabase
  * anon client. RLS on `component_documents` enforces read-only.
  *
- * Env:
+ * Zero-config: the public Mzizi registry URL + publishable key are baked in
+ * as defaults (see defaults.ts — they are not secrets), so `npx mzizi-mcp`
+ * works with no environment set. This is the sanctioned headless path: the
+ * hosted mcp.mzizi.dev endpoint sits behind an interactive, browser-only
+ * WorkOS signup gate that a headless agent cannot complete, whereas this bin
+ * reads the same public registry directly.
+ *
+ * Env (optional — override the defaults to point at a fork / self-hosted
+ * mirror):
  *   SUPABASE_URL              (or NEXT_PUBLIC_SUPABASE_URL)
  *   SUPABASE_PUBLISHABLE_KEY  (or NEXT_PUBLIC_SUPABASE_ANON_KEY)
  */

package/dist/stdio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG"}
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;GAkBG"}

package/dist/stdio.js

@@ -1,22 +1,37 @@
 #!/usr/bin/env node
 /**
- * stdio entry — for the MCP registry (`npx mzizi-mcp`).
+ * stdio entry — for the MCP registry (`npx mzizi-mcp`) and local MCP clients
+ * (Claude Code, etc.).
  *
  * Spawns the server over the stdio transport, using a long-lived Supabase
  * anon client. RLS on `component_documents` enforces read-only.
  *
- * Env:
+ * Zero-config: the public Mzizi registry URL + publishable key are baked in
+ * as defaults (see defaults.ts — they are not secrets), so `npx mzizi-mcp`
+ * works with no environment set. This is the sanctioned headless path: the
+ * hosted mcp.mzizi.dev endpoint sits behind an interactive, browser-only
+ * WorkOS signup gate that a headless agent cannot complete, whereas this bin
+ * reads the same public registry directly.
+ *
+ * Env (optional — override the defaults to point at a fork / self-hosted
+ * mirror):
  *   SUPABASE_URL              (or NEXT_PUBLIC_SUPABASE_URL)
  *   SUPABASE_PUBLISHABLE_KEY  (or NEXT_PUBLIC_SUPABASE_ANON_KEY)
  */
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { createClient } from "@supabase/supabase-js";
 import { createMziziMcpServer } from "./server.js";
+import { DEFAULT_SUPABASE_URL, DEFAULT_SUPABASE_PUBLISHABLE_KEY } from "./defaults.js";
 async function main() {
-    const url = process.env.SUPABASE_URL ?? process.env.NEXT_PUBLIC_SUPABASE_URL ?? "";
-    const key = process.env.SUPABASE_PUBLISHABLE_KEY ?? process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ?? "";
+    const url = process.env.SUPABASE_URL ?? process.env.NEXT_PUBLIC_SUPABASE_URL ?? DEFAULT_SUPABASE_URL;
+    const key = process.env.SUPABASE_PUBLISHABLE_KEY ??
+        process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ??
+        DEFAULT_SUPABASE_PUBLISHABLE_KEY;
     if (!url || !key) {
-        process.stderr.write("mzizi-mcp: missing SUPABASE_URL or SUPABASE_PUBLISHABLE_KEY (NEXT_PUBLIC_ equivalents are accepted)\n");
+        // Unreachable with the baked defaults, but keep an actionable message in
+        // case someone explicitly sets one var to an empty string.
+        process.stderr.write("mzizi-mcp: missing SUPABASE_URL or SUPABASE_PUBLISHABLE_KEY. Leave both unset to use " +
+            "the public Mzizi registry defaults, or set them to point at a fork / self-hosted mirror.\n");
         process.exit(1);
     }
     const supabase = createClient(url, key, {

package/dist/stdio.js.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAElD,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAA;IAClF,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,EAAE,CAAA;IACzF,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uGAAuG,CACxG,CAAA;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;QACtC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;KACzD,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAA;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;AACjC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAA;IAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,oBAAoB,EAAE,gCAAgC,EAAE,MAAM,eAAe,CAAA;AAEtF,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,oBAAoB,CAAA;IAC1F,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACpC,OAAO,CAAC,GAAG,CAAC,6BAA6B;QACzC,gCAAgC,CAAA;IAClC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,yEAAyE;QACzE,2DAA2D;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uFAAuF;YACrF,4FAA4F,CAC/F,CAAA;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;QACtC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;KACzD,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAA;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;AACjC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,OAAO,IAAI,CAAC,CAAA;IAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nyuchi/mzizi-mcp",
-  "version": "0.5.0-beta.1",
+  "version": "0.5.0-beta.2",
   "publishConfig": {
     "access": "public"
   },