@sourcey/mcp-server 1.0.0

package/SECURITY.md

@@ -0,0 +1,8 @@
+# Security
+
+Report vulnerabilities privately through GitHub Security Advisories for
+`sourcey/mcp-server`. Do not include credentials, wallet material, private Catalog data, or
+personal information in a public issue.
+
+The bridge accepts no Sourcey credential. Its only network destination is the canonical hosted
+endpoint or the explicit `SOURCEY_MCP_URL` override, which must use HTTPS except on loopback.

package/SUPPORT.md

@@ -0,0 +1,5 @@
+# Support
+
+Use [GitHub issues](https://github.com/sourcey/mcp-server/issues) for reproducible package,
+transport, metadata, or compatibility defects. Use [sourcey.com/support](https://sourcey.com/support)
+for Sourcey product support.

package/dist/bridge.d.ts

@@ -0,0 +1,24 @@
+import { Client, type Tool, type Transport } from "@modelcontextprotocol/client";
+export interface BridgeTimeouts {
+    readonly connectMs: number;
+    readonly listMs: number;
+    readonly callMs: number;
+    readonly closeMs: number;
+}
+export declare const defaultBridgeTimeouts: BridgeTimeouts;
+export interface SourceyBridgeInput {
+    readonly endpoint: URL;
+    readonly timeouts?: BridgeTimeouts;
+    readonly diagnostic?: (message: string) => void;
+    readonly onUpstreamClose?: () => void;
+}
+export interface SourceyBridge {
+    readonly endpoint: URL;
+    readonly hostedImplementation: ReturnType<Client["getServerVersion"]>;
+    readonly tools: readonly Tool[];
+    connect(transport: Transport): Promise<void>;
+    close(): Promise<void>;
+}
+export declare function createSourceyBridge(input: SourceyBridgeInput): Promise<SourceyBridge>;
+export declare function sourceyMcpEndpoint(environment: NodeJS.ProcessEnv): URL;
+//# sourceMappingURL=bridge.d.ts.map

package/dist/bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,MAAM,EAGN,KAAK,IAAI,EACT,KAAK,SAAS,EACf,MAAM,8BAA8B,CAAC;AAItC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,qBAAqB,EAAE,cAKnC,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC;IACvB,QAAQ,CAAC,oBAAoB,EAAE,UAAU,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IAChC,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC,CAiE3F;AAED,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,GAAG,CActE"}

package/dist/bridge.js

@@ -0,0 +1,105 @@
+import { Client, StreamableHTTPClientTransport, } from "@modelcontextprotocol/client";
+import { Server } from "@modelcontextprotocol/server";
+import { bridgeDistribution, bridgeImplementation } from "./metadata.js";
+export const defaultBridgeTimeouts = {
+    connectMs: 15_000,
+    listMs: 15_000,
+    callMs: 60_000,
+    closeMs: 5_000,
+};
+export async function createSourceyBridge(input) {
+    const timeouts = input.timeouts ?? defaultBridgeTimeouts;
+    const upstream = new Client(bridgeImplementation, {
+        capabilities: {},
+        enforceStrictCapabilities: true,
+        versionNegotiation: { mode: "legacy" },
+    });
+    const upstreamTransport = new StreamableHTTPClientTransport(input.endpoint);
+    let closing = false;
+    upstream.onerror = (error) => input.diagnostic?.(`upstream error: ${error.message}`);
+    upstream.onclose = () => {
+        if (!closing)
+            input.onUpstreamClose?.();
+    };
+    await upstream.connect(upstreamTransport, requestOptions(timeouts.connectMs));
+    const listed = await upstream.listTools(undefined, {
+        ...requestOptions(timeouts.listMs),
+        cacheMode: "refresh",
+    });
+    if (listed.tools.length === 0) {
+        await upstream.close();
+        throw new Error("The hosted Sourcey MCP server returned no tools.");
+    }
+    const tools = Object.freeze([...listed.tools]);
+    const toolsByName = new Map(tools.map((tool) => [tool.name, tool]));
+    const hosted = upstream.getServerVersion();
+    const hostedIdentity = hosted ? `${hosted.name}@${hosted.version}` : input.endpoint.origin;
+    const upstreamInstructions = upstream.getInstructions();
+    const server = new Server(bridgeImplementation, {
+        capabilities: { tools: { listChanged: false } },
+        instructions: [
+            `This installed stdio process is ${bridgeImplementation.name}@${bridgeImplementation.version}.`,
+            `It relays the live hosted Sourcey server ${hostedIdentity}.`,
+            upstreamInstructions,
+        ]
+            .filter((value) => Boolean(value))
+            .join(" "),
+    });
+    server.setRequestHandler("tools/list", () => ({ tools: [...tools] }));
+    server.setRequestHandler("tools/call", async (request) => {
+        const tool = toolsByName.get(request.params.name);
+        if (!tool)
+            throw new Error(`Unknown Sourcey tool: ${request.params.name}.`);
+        const result = await upstream.callTool(request.params, {
+            ...requestOptions(timeouts.callMs),
+            toolDefinition: tool,
+        });
+        return server.projectCallToolResult(result, tool.outputSchema);
+    });
+    return {
+        endpoint: input.endpoint,
+        hostedImplementation: hosted,
+        tools,
+        connect: (transport) => server.connect(transport),
+        close: async () => {
+            if (closing)
+                return;
+            closing = true;
+            await Promise.allSettled([
+                boundedClose("local MCP server", () => server.close(), timeouts.closeMs),
+                boundedClose("hosted MCP client", () => upstream.close(), timeouts.closeMs),
+            ]);
+        },
+    };
+}
+export function sourceyMcpEndpoint(environment) {
+    const endpoint = new URL(environment.SOURCEY_MCP_URL ?? bridgeDistribution.default_endpoint);
+    if (endpoint.username || endpoint.password || endpoint.hash) {
+        throw new Error("SOURCEY_MCP_URL must not contain credentials or a fragment.");
+    }
+    if (endpoint.protocol !== "https:" &&
+        !(endpoint.protocol === "http:" && ["127.0.0.1", "::1", "localhost"].includes(endpoint.hostname))) {
+        throw new Error("SOURCEY_MCP_URL must use HTTPS, except for a loopback test endpoint.");
+    }
+    return endpoint;
+}
+function requestOptions(timeout) {
+    return { timeout, maxTotalTimeout: timeout };
+}
+async function boundedClose(label, close, timeout) {
+    let timer;
+    try {
+        await Promise.race([
+            close(),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`${label} did not close within ${timeout}ms.`)), timeout);
+                timer.unref();
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=bridge.js.map

package/dist/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,MAAM,EAEN,6BAA6B,GAG9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AASzE,MAAM,CAAC,MAAM,qBAAqB,GAAmB;IACnD,SAAS,EAAE,MAAM;IACjB,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,OAAO,EAAE,KAAK;CACf,CAAC;AAiBF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAyB;IACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,oBAAoB,EAAE;QAChD,YAAY,EAAE,EAAE;QAChB,yBAAyB,EAAE,IAAI;QAC/B,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACvC,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,IAAI,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5E,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,QAAQ,CAAC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,mBAAmB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,QAAQ,CAAC,OAAO,GAAG,GAAG,EAAE;QACtB,IAAI,CAAC,OAAO;YAAE,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;IAC1C,CAAC,CAAC;IAEF,MAAM,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE;QACjD,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;QAClC,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,gBAAgB,EAAE,CAAC;IAC3C,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC3F,MAAM,oBAAoB,GAAG,QAAQ,CAAC,eAAe,EAAE,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,oBAAoB,EAAE;QAC9C,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;QAC/C,YAAY,EAAE;YACZ,mCAAmC,oBAAoB,CAAC,IAAI,IAAI,oBAAoB,CAAC,OAAO,GAAG;YAC/F,4CAA4C,cAAc,GAAG;YAC7D,oBAAoB;SACrB;aACE,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;aAClD,IAAI,CAAC,GAAG,CAAC;KACb,CAAC,CAAC;IAEH,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE,GAAoB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAA2B,EAAE;QAChF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE;YACrD,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;YAClC,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,oBAAoB,EAAE,MAAM;QAC5B,KAAK;QACL,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACjD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvB,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC;gBACxE,YAAY,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC;aAC5E,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,WAA8B;IAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,eAAe,IAAI,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IAC7F,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IACE,QAAQ,CAAC,QAAQ,KAAK,QAAQ;QAC9B,CAAC,CACC,QAAQ,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC/F,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAW,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,KAA0B,EAAE,OAAe;IACpF,IAAI,KAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,KAAK,EAAE;YACP,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,OAAO,KAAK,CAAC,CAAC,EACtE,OAAO,CACR,CAAC;gBACF,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
+import { createSourceyBridge, sourceyMcpEndpoint } from "./bridge.js";
+const note = (message) => process.stderr.write(`[sourcey-mcp] ${message}\n`);
+let bridge;
+let shuttingDown = false;
+async function shutdown(reason, exitCode) {
+    if (shuttingDown)
+        return;
+    shuttingDown = true;
+    note(reason);
+    await bridge?.close();
+    process.exitCode = exitCode;
+}
+async function main() {
+    const endpoint = sourceyMcpEndpoint(process.env);
+    bridge = await createSourceyBridge({
+        endpoint,
+        diagnostic: note,
+        onUpstreamClose: () => void shutdown("hosted Sourcey connection closed", 1),
+    });
+    for (const signal of ["SIGINT", "SIGTERM"]) {
+        process.once(signal, () => void shutdown(`received ${signal}`, 0));
+    }
+    await bridge.connect(new StdioServerTransport());
+    note(`bridging ${endpoint.origin}${endpoint.pathname}`);
+}
+main().catch((error) => {
+    note(`failed to start: ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAsB,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE1F,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,OAAO,IAAI,CAAC,CAAC;AACrF,IAAI,MAAiC,CAAC;AACtC,IAAI,YAAY,GAAG,KAAK,CAAC;AAEzB,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,QAAgB;IACtD,IAAI,YAAY;QAAE,OAAO;IACzB,YAAY,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC,MAAM,CAAC,CAAC;IACb,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;IACtB,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACjC,QAAQ;QACR,UAAU,EAAE,IAAI;QAChB,eAAe,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,kCAAkC,EAAE,CAAC,CAAC;KAC5E,CAAC,CAAC;IACH,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,YAAY,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,YAAY,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,IAAI,CAAC,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/metadata.d.ts

@@ -0,0 +1,77 @@
+import type { Implementation } from "@modelcontextprotocol/server";
+export declare const bridgeDistribution: {
+    distribution_contract: string;
+    registry_name: string;
+    implementation_name: string;
+    title: string;
+    registry_description: string;
+    description: string;
+    default_endpoint: string;
+    website_url: string;
+    support_url: string;
+    privacy_url: string;
+    terms_url: string;
+    x402_discovery_url: string;
+    icon: {
+        src: string;
+        mime_type: string;
+        sizes: string[];
+        local_path: string;
+        sha256: string;
+    };
+    repository: string;
+    container: string;
+    glama_maintainers: string[];
+};
+export declare const bridgePackage: {
+    name: string;
+    version: string;
+    description: string;
+    mcpName: string;
+    license: string;
+    type: string;
+    bin: {
+        "sourcey-mcp": string;
+    };
+    files: string[];
+    repository: {
+        type: string;
+        url: string;
+    };
+    homepage: string;
+    bugs: {
+        url: string;
+    };
+    funding: string;
+    author: string;
+    keywords: string[];
+    engines: {
+        node: string;
+    };
+    scripts: {
+        build: string;
+        "generate:metadata": string;
+        "generate:sbom": string;
+        "check:metadata": string;
+        lint: string;
+        test: string;
+        "verify:package": string;
+        verify: string;
+        start: string;
+    };
+    dependencies: {
+        "@modelcontextprotocol/client": string;
+        "@modelcontextprotocol/server": string;
+    };
+    devDependencies: {
+        "@biomejs/biome": string;
+        "@types/node": string;
+        typescript: string;
+    };
+    publishConfig: {
+        access: string;
+        provenance: boolean;
+    };
+};
+export declare const bridgeImplementation: Implementation;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../src/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAInE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;CAAe,CAAC;AAC/C,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAkB,CAAC;AAE7C,eAAO,MAAM,oBAAoB,EAAE,cAalC,CAAC"}

package/dist/metadata.js

@@ -0,0 +1,19 @@
+import distribution from "../distribution.json" with { type: "json" };
+import packageManifest from "../package.json" with { type: "json" };
+export const bridgeDistribution = distribution;
+export const bridgePackage = packageManifest;
+export const bridgeImplementation = {
+    name: distribution.implementation_name,
+    title: distribution.title,
+    version: packageManifest.version,
+    description: distribution.registry_description,
+    icons: [
+        {
+            src: distribution.icon.src,
+            mimeType: distribution.icon.mime_type,
+            sizes: distribution.icon.sizes,
+        },
+    ],
+    websiteUrl: distribution.website_url,
+};
+//# sourceMappingURL=metadata.js.map

package/dist/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../src/metadata.ts"],"names":[],"mappings":"AACA,OAAO,YAAY,MAAM,sBAAsB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AACtE,OAAO,eAAe,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAEpE,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAC/C,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC;AAE7C,MAAM,CAAC,MAAM,oBAAoB,GAAmB;IAClD,IAAI,EAAE,YAAY,CAAC,mBAAmB;IACtC,KAAK,EAAE,YAAY,CAAC,KAAK;IACzB,OAAO,EAAE,eAAe,CAAC,OAAO;IAChC,WAAW,EAAE,YAAY,CAAC,oBAAoB;IAC9C,KAAK,EAAE;QACL;YACE,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG;YAC1B,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS;YACrC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK;SAC/B;KACF;IACD,UAAU,EAAE,YAAY,CAAC,WAAW;CACrC,CAAC"}

package/distribution.json

@@ -0,0 +1,24 @@
+{
+  "distribution_contract": "sourcey.mcp-bridge-distribution/v1alpha1",
+  "registry_name": "io.github.sourcey/mcp-server",
+  "implementation_name": "sourcey-mcp-bridge",
+  "title": "Sourcey",
+  "registry_description": "Stdio bridge to Sourcey startup offers and Agent Readiness report cards.",
+  "description": "A thin local stdio bridge to Sourcey's live hosted MCP server for evidence-backed startup credits, deals, Agent Readiness report cards, canonical declarations, and paid-service discovery.",
+  "default_endpoint": "https://mcp.sourcey.com/mcp",
+  "website_url": "https://sourcey.com",
+  "support_url": "https://sourcey.com/support",
+  "privacy_url": "https://sourcey.com/privacy",
+  "terms_url": "https://sourcey.com/terms",
+  "x402_discovery_url": "https://api.sourcey.com/.well-known/x402",
+  "icon": {
+    "src": "https://sourcey.com/brand/sourcey-mark.png",
+    "mime_type": "image/png",
+    "sizes": ["250x250"],
+    "local_path": "assets/sourcey-mark.png",
+    "sha256": "7e6a3cc157c0cf8b984668ab9d3d2697207815240e07958343b17fdbf192233d"
+  },
+  "repository": "https://github.com/sourcey/mcp-server",
+  "container": "ghcr.io/sourcey/mcp-server",
+  "glama_maintainers": ["auscaster"]
+}

package/package.json

@@ -0,0 +1,72 @@
+{
+  "name": "@sourcey/mcp-server",
+  "version": "1.0.0",
+  "description": "Installable stdio bridge to Sourcey's live startup offers and Agent Readiness MCP server.",
+  "mcpName": "io.github.sourcey/mcp-server",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "sourcey-mcp": "dist/index.js"
+  },
+  "files": [
+    "assets",
+    "dist",
+    "CHANGELOG.md",
+    "distribution.json",
+    "LICENSE",
+    "README.md",
+    "SBOM.cdx.json",
+    "SECURITY.md",
+    "server.json",
+    "SUPPORT.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sourcey/mcp-server.git"
+  },
+  "homepage": "https://sourcey.com",
+  "bugs": {
+    "url": "https://github.com/sourcey/mcp-server/issues"
+  },
+  "funding": "https://sourcey.com",
+  "author": "Sourcey",
+  "keywords": [
+    "sourcey",
+    "mcp",
+    "model-context-protocol",
+    "mcp-server",
+    "startup-credits",
+    "startup-deals",
+    "agent-readiness",
+    "agent-report-card",
+    "x402",
+    "ai-agents"
+  ],
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "scripts": {
+    "build": "node scripts/clean.mjs && tsc -p tsconfig.json",
+    "generate:metadata": "node scripts/generate-metadata.mjs",
+    "generate:sbom": "node scripts/generate-sbom.mjs",
+    "check:metadata": "node scripts/check-metadata.mjs",
+    "lint": "biome check .",
+    "test": "node --test test/*.test.mjs",
+    "verify:package": "node scripts/verify-packed-package.mjs",
+    "verify": "npm run build && npm run generate:metadata && npm run generate:sbom && npm run check:metadata && npm run lint && npm test && npm run verify:package",
+    "start": "node dist/index.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/client": "2.0.0",
+    "@modelcontextprotocol/server": "2.0.0"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.5.5",
+    "@types/node": "24.10.1",
+    "typescript": "6.0.3"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
+}

package/server.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.sourcey/mcp-server",
+  "title": "Sourcey",
+  "description": "Stdio bridge to Sourcey startup offers and Agent Readiness report cards.",
+  "version": "1.0.0",
+  "websiteUrl": "https://sourcey.com",
+  "icons": [
+    {
+      "src": "https://sourcey.com/brand/sourcey-mark.png",
+      "mimeType": "image/png",
+      "sizes": [
+        "250x250"
+      ]
+    }
+  ],
+  "repository": {
+    "url": "https://github.com/sourcey/mcp-server",
+    "source": "github"
+  },
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "@sourcey/mcp-server",
+      "version": "1.0.0",
+      "transport": {
+        "type": "stdio"
+      }
+    }
+  ]
+}