@skeletiq/mcp 0.6.1 → 0.7.1

package/README.md

@@ -56,6 +56,8 @@ Run `npx -y @skeletiq/mcp` over stdio with `SKELETIQ_API_KEY` in the environment
 | `SKELETIQ_API_KEY` | yes | — | A personal API token, starting `skq_`. Not a browser session token. |
 | `SKELETIQ_API_URL` | no | `https://api.skeletiq.com` | For self-hosted installs. A trailing `/api/v1` is accepted and trimmed. |
 
+Every request carries a User-Agent of the form `skeletiq-mcp/<version> (<host name>/<host version>)`, naming the MCP host that launched the server.
+
 ## Scopes
 
 A token grants only what you tick. The server's tools need:

package/dist/index.js

@@ -5,7 +5,7 @@ import { serveStdio } from "@modelcontextprotocol/server/stdio";
 
 // src/config.ts
 var SERVER_NAME = "skeletiq";
-var SERVER_VERSION = "0.6.1";
+var SERVER_VERSION = "0.7.1";
 var AGENT_SCHEMA_VERSION = 2;
 function schemaNote(serverVersion) {
   if (serverVersion === void 0 || serverVersion <= AGENT_SCHEMA_VERSION) return null;
@@ -199,12 +199,28 @@ function describeApiError(error) {
 
 // src/http/client.ts
 var API_PREFIX = "/api/v1";
+var HOST_TOKEN_MAX = 64;
+function hostToken(value) {
+  return value.replace(/[^A-Za-z0-9._~+-]/g, "-").slice(0, HOST_TOKEN_MAX);
+}
+function userAgent(host) {
+  const base = `${SERVER_NAME}-mcp/${SERVER_VERSION}`;
+  const name = hostToken(host?.name ?? "");
+  if (!name) return base;
+  const version = hostToken(host?.version ?? "");
+  return version ? `${base} (${name}/${version})` : `${base} (${name})`;
+}
 var READ_TIMEOUT_MS = 6e5;
 var SkeletiqClient = class {
   config;
+  hostSource;
   constructor(config) {
     this.config = config;
   }
+  /** Where to read the connected host's name and version from, for the User-Agent. */
+  setHostSource(source) {
+    this.hostSource = source;
+  }
   /** A parsed JSON response, or a thrown `SkeletiqApiError` carrying the server's own words. */
   async request(path2, options = {}) {
     const response = await this.fetch(path2, options);
@@ -223,7 +239,7 @@ var SkeletiqClient = class {
         headers: {
           Authorization: `Bearer ${this.config.apiKey}`,
           Accept: "application/json",
-          "User-Agent": `${SERVER_NAME}-mcp/${SERVER_VERSION}`,
+          "User-Agent": userAgent(this.hostSource?.()),
           ...options.body === void 0 ? {} : { "Content-Type": "application/json" },
           ...options.headers
         },
@@ -625,6 +641,11 @@ var CritiqueFindingSchema = z.looseObject({
   remediation: z.string().optional(),
   /** Reported in full and never charged against the score — advice, not a problem to fix. */
   advisory_only: z.boolean().optional(),
+  /**
+   * Whether this finding can hold a design back from Ready. Absent or null means not stated, and
+   * the standing Ready rule applies to it.
+   */
+  holds_ready: z.boolean().nullable().optional(),
   /**
    * The problem this finding is about. Stable across rewording, and shared with the advisor
    * suggestion and decision record raised by the same problem — the key a dismissal is recorded
@@ -1455,6 +1476,7 @@ var input3 = z5.object({
 });
 var SCORE_BASIS_FINDINGS_ONLY = "findings_only";
 var SCORE_BASIS_NOTE = "This score is findings only. It is not held to a traceability ceiling, because this tool is given a design and no requirement set to trace it against. The app can show a lower number for the same stored design for exactly that reason.";
+var COMPLIANCE_INDICATIVE_NOTE = "Indicative automated check based on architecture structure \u2014 not a certified compliance audit or legal advice.";
 var output3 = z5.object({
   architecture_score: z5.number(),
   score_basis: z5.literal(SCORE_BASIS_FINDINGS_ONLY).describe(SCORE_BASIS_NOTE),
@@ -1537,7 +1559,7 @@ function registerCritique(server, client) {
         // An agent that reads only the text has to see this too. Without it, "the app
         // said 59 and the tool said 74" is an unexplained contradiction it will either
         // resolve wrongly or report as a bug.
-        complianceAssessed ? `Compliance checked against ${(critique.frameworks_checked ?? []).join(", ")} \u2014 the frameworks systems in this domain are usually held to, inferred from the domain you sent rather than from a regime anyone named. Confirm them.` : critique.compliance_note ?? "Compliance was not assessed.",
+        complianceAssessed ? `Compliance checked against ${(critique.frameworks_checked ?? []).join(", ")} \u2014 the frameworks systems in this domain are usually held to, inferred from the domain you sent rather than from a regime anyone named. Confirm them. ` + COMPLIANCE_INDICATIVE_NOTE : `${critique.compliance_note ?? "Compliance was not assessed."} ${COMPLIANCE_INDICATIVE_NOTE}`,
         // Only when the exposure used is not the one the agent chose. When a
         // non-public exposure *was* applied the server returns an
         // `exposure_scoped_checks` finding naming exactly which checks it took off
@@ -1660,13 +1682,13 @@ function frameDetail(frame) {
 var constraintsInput = z6.strictObject({
   budget: z6.enum(["low", "medium", "high", "unlimited"]).optional(),
   max_latency_ms: z6.number().int().positive().optional(),
-  // Free strings, not an enum, and the description has to say why. SkeletIQ assesses five
+  // Free strings, not an enum, and the description has to say why. SkeletIQ assesses six
   // frameworks; naming anything else is still worth doing, because an unassessed regime is
   // recorded and reaches the design brief as a requirement the agent still has to satisfy.
   // The old text read 'e.g. HIPAA, SOC2, PCI-DSS, GDPR' — it omitted SOX, which is the one
   // an agent is least likely to guess, and said nothing about what happens to the rest.
   compliance: z6.array(z6.string()).optional().describe(
-    "Regimes the design must satisfy. SOC2, HIPAA, PCI-DSS, GDPR and SOX are checked against requirement catalogues; any other regime is recorded and carried into the design brief as a requirement to satisfy, rather than checked."
+    "Regimes the design must satisfy. SOC2, HIPAA, PCI-DSS, GDPR, SOX and DPDP (India) are checked against requirement catalogues; any other regime is recorded and carried into the design brief as a requirement to satisfy, rather than checked."
   ),
   preferred_cloud: z6.enum(["aws", "gcp", "azure", "any"]).optional(),
   preferred_technologies: z6.array(z6.string()).optional(),
@@ -2833,6 +2855,7 @@ function buildServer(client, resolver) {
     { name: SERVER_NAME, version: SERVER_VERSION },
     { instructions: INSTRUCTIONS, capabilities: { tools: {} } }
   );
+  client.setHostSource(() => server.server.getClientVersion());
   registerListProjects(server, resolver);
   registerGetDesign(server, client, resolver);
   registerGenerate(server, client, resolver);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skeletiq/mcp",
-  "version": "0.6.1",
+  "version": "0.7.1",
   "description": "Design in SkeletIQ, build with your coding agent. MCP server for the SkeletIQ architecture platform.",
   "license": "MIT",
   "author": "Sabhahith Works Private Limited",