@sourcey/mcp-server 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# Changelog
+
+## 1.0.0
+
+- Initial public stdio bridge to Sourcey's hosted MCP server.
+- Dynamic hosted tool discovery with bounded connect, list, call, and shutdown behavior.
+- Complete npm, MCP Registry, Glama, container, SBOM, and provenance metadata.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sourcey
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,70 @@
+# Sourcey MCP Server
+
+Find evidence-backed startup credits and deals, inspect Agent Readiness report cards, and
+prepare canonical service declarations from an agent client.
+
+Sourcey is already a hosted Streamable HTTP MCP server:
+
+```text
+https://mcp.sourcey.com/mcp
+```
+
+Use that URL directly when your client supports remote MCP. This package is the thin stdio
+bridge for clients that require a local command:
+
+```bash
+npx -y @sourcey/mcp-server
+```
+
+```json
+{
+  "mcpServers": {
+    "sourcey": {
+      "command": "npx",
+      "args": ["-y", "@sourcey/mcp-server"]
+    }
+  }
+}
+```
+
+The bridge downloads no Catalog and contains no tool implementations. At startup it negotiates
+with the live Sourcey server, reads the current tool definitions once, and relays tool calls. A
+Catalog or tool-description update therefore needs no package release.
+
+## What agents can do
+
+- search and compare current startup credits, discounts, free tiers, programs, perks, and deals;
+- inspect exact evidence, freshness, eligibility unknowns, and the signed change feed;
+- search and inspect Agent Readiness report cards, including visible grades, five-stage findings,
+  blockers, remediations, methods, coverage, and freshness;
+- prepare canonical Agent Readiness declaration YAML without assigning a grade; and
+- discover Sourcey's paid HTTP services and x402 endpoint without paying inside MCP.
+
+Call `tools/list` for the exact live schemas and descriptions. Sourcey's full agent guide is at
+[sourcey.com/SKILL.md](https://sourcey.com/SKILL.md), its OpenAPI contract is at
+[api.sourcey.com/openapi.yml](https://api.sourcey.com/openapi.yml), and x402 discovery is at
+[api.sourcey.com/.well-known/x402](https://api.sourcey.com/.well-known/x402).
+
+## Boundary
+
+This package performs only two actions: MCP over local stdio and MCP over the configured hosted
+HTTP endpoint. It has no wallet, payment signer, credentials, telemetry, browser, background
+daemon, mutable plugin, Catalog data, Agent Readiness executor, or submission authority. Paid
+work remains on Sourcey's canonical HTTP API.
+
+`SOURCEY_MCP_URL` may select another HTTPS Sourcey endpoint. Plain HTTP is accepted only for a
+loopback test server. URLs containing credentials or fragments are refused.
+
+## Development
+
+```bash
+npm ci
+npm run verify
+docker build -t sourcey-mcp .
+```
+
+The verification path builds from clean output, checks all generated metadata, tests the real
+HTTP-to-stdio boundary, creates an SBOM, installs the exact packed tarball into a blank project,
+and repeats protocol introspection from those installed bytes.
+
+MIT. See `SECURITY.md` and `SUPPORT.md` for reporting paths.