@tacitai/mcp-server 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Quarterback AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,71 @@
+# Tacit — the knowledge backend for Claude Code
+
+[![npm](https://img.shields.io/npm/v/@tacit/mcp-server)](https://www.npmjs.com/package/@tacit/mcp-server)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
+<!-- demo GIF: docs/assets/demo.gif TODO -->
+
+## What is this?
+
+`@tacit/mcp-server` is a stdio Model Context Protocol (MCP) server that wraps
+the Tacit `/api/v1` REST and SSE API. It turns a running Tacit instance into a
+knowledge backend for Claude Code: your workspace knowledge, artifacts, and
+synthesis pipeline become first-class tools available inside every Claude Code
+session — no copy-paste, no context switching.
+
+## Quick start
+
+Run the interactive setup wizard (requires a running Tacit instance):
+
+```bash
+npx @tacit/mcp-server setup
+```
+
+Pre-publication (from source):
+
+```bash
+node packages/tacit-mcp-server/dist/index.js setup
+```
+
+The wizard writes the `tacit` entry directly to `~/.claude/mcp.json`
+(preserving the `${TACIT_TOKEN}` env reference) and validates connectivity
+before it exits.
+
+<!-- TODO: update to published docs URL after MV-1057g merges -->
+
+## Documentation
+
+- [Quickstart](../../docs/content/quickstart.md)
+- [API reference](../../docs/content/api-reference.md)
+- [SDK reference](../../docs/content/sdk-reference.md)
+
+## Available MCP tools
+
+| Tool | Description |
+| ---- | ----------- |
+| `synthesize` | Stream a grounded synthesis answer from workspace knowledge |
+| `search` | Semantic and keyword search across workspace artifacts |
+| `recall` | Retrieve Chronicle events and timeline context |
+| `artifacts` | List, read, and create workspace artifacts |
+| `ingest` | Ingest documents or URLs into the workspace knowledge base |
+
+## Requirements
+
+- Node.js >= 18
+- A running Tacit instance reachable at a configurable base URL
+- A valid Tacit API token
+
+## Repository
+
+Source: <https://github.com/scottkmcmillan/tacit>
+
+Directory: `packages/tacit-mcp-server`
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for build, test, and pull request
+instructions.
+
+## License
+
+[MIT](LICENSE) — Copyright (c) 2026 Quarterback AI.

package/dist/client.d.ts

@@ -0,0 +1,60 @@
+/**
+ * TacitClient — REST/SSE client over TACIT_API_URL.
+ *
+ * Security invariants (enforced here and NEVER relaxed):
+ *  - TACIT_TOKEN is NEVER written to any output stream (stdout, stderr, logs).
+ *  - The Authorization header value is NEVER logged at any level.
+ *  - No anthropic/openai SDK import.
+ *  - Token sourced exclusively from process.env.TACIT_TOKEN.
+ */
+export interface TacitClientOptions {
+    apiUrl?: string;
+    token?: string;
+    workspaceId?: string;
+    /** Override the root directory used to locate .tacit/sync.json (default: process.cwd()). */
+    rootDir?: string;
+}
+export declare class TacitClient {
+    private readonly apiUrl;
+    private readonly token;
+    private readonly _fetch;
+    private readonly _rootDir;
+    readonly workspaceId: string;
+    /**
+     * @param fetchOrOpts - Optional: a custom fetch implementation (for testing),
+     *   or a TacitClientOptions object. If a function is provided it overrides
+     *   global fetch. Configuration falls back to environment variables.
+     * @param opts - Additional options (apiUrl, token, workspaceId, rootDir).
+     *   Only used when fetchOrOpts is a fetch function.
+     */
+    constructor(fetchOrOpts?: typeof globalThis.fetch | TacitClientOptions, opts?: TacitClientOptions);
+    /**
+     * Resolve the workspace ID:
+     *   1. Read workspace_id from <rootDir>/.tacit/sync.json if the file exists.
+     *   2. Fall back to TACIT_WORKSPACE_ID env var.
+     *   3. Return null if neither source is available.
+     */
+    resolveWorkspaceId(): Promise<string | null>;
+    /** Build auth headers. Value is NEVER written to logs. */
+    private authHeaders;
+    /** GET request returning parsed JSON. */
+    get<T = unknown>(endpoint: string, params?: Record<string, string | number | boolean | undefined>): Promise<T>;
+    /** POST request returning parsed JSON. */
+    post<T = unknown>(endpoint: string, body: unknown): Promise<T>;
+    /** PATCH request returning parsed JSON. */
+    patch<T = unknown>(endpoint: string, body: unknown): Promise<T>;
+    /**
+     * POST to an SSE endpoint, returning an async generator of text chunks.
+     * The Authorization header value is never written to process.stderr or stdout.
+     */
+    postSSE(endpoint: string, body: unknown): AsyncGenerator<string>;
+    /** POST multipart form data (for file ingest). */
+    postFormData<T = unknown>(endpoint: string, formData: FormData): Promise<T>;
+}
+export declare class TacitApiError extends Error {
+    readonly statusCode: number;
+    readonly body: string;
+    readonly endpoint: string;
+    constructor(statusCode: number, body: string, endpoint: string);
+}
+export declare function getClient(): TacitClient;

package/dist/client.js

@@ -0,0 +1,265 @@
+"use strict";
+// SPDX-License-Identifier: MIT
+/**
+ * TacitClient — REST/SSE client over TACIT_API_URL.
+ *
+ * Security invariants (enforced here and NEVER relaxed):
+ *  - TACIT_TOKEN is NEVER written to any output stream (stdout, stderr, logs).
+ *  - The Authorization header value is NEVER logged at any level.
+ *  - No anthropic/openai SDK import.
+ *  - Token sourced exclusively from process.env.TACIT_TOKEN.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TacitApiError = exports.TacitClient = void 0;
+exports.getClient = getClient;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+class TacitClient {
+    apiUrl;
+    token;
+    _fetch;
+    _rootDir;
+    workspaceId;
+    /**
+     * @param fetchOrOpts - Optional: a custom fetch implementation (for testing),
+     *   or a TacitClientOptions object. If a function is provided it overrides
+     *   global fetch. Configuration falls back to environment variables.
+     * @param opts - Additional options (apiUrl, token, workspaceId, rootDir).
+     *   Only used when fetchOrOpts is a fetch function.
+     */
+    constructor(fetchOrOpts, opts = {}) {
+        let resolvedOpts = {};
+        if (typeof fetchOrOpts === 'function') {
+            this._fetch = fetchOrOpts;
+            resolvedOpts = opts;
+        }
+        else {
+            if (fetchOrOpts)
+                resolvedOpts = fetchOrOpts;
+            this._fetch = globalThis.fetch.bind(globalThis);
+        }
+        this.apiUrl = (resolvedOpts.apiUrl ?? process.env['TACIT_API_URL'] ?? 'http://localhost:7473').replace(/\/$/, '');
+        // Token from env only — NEVER log this value.
+        this.token = resolvedOpts.token ?? process.env['TACIT_TOKEN'] ?? '';
+        this._rootDir = resolvedOpts.rootDir ?? process.cwd();
+        // MV-1057e: read workspace_id from .tacit/sync.json if present.
+        // Whichever mission (1057c or 1057e) lands second wires the full schema.
+        let resolvedWorkspaceId = resolvedOpts.workspaceId ?? process.env['TACIT_WORKSPACE_ID'] ?? '';
+        try {
+            const syncPath = path.join(this._rootDir, '.tacit', 'sync.json');
+            if (fs.existsSync(syncPath)) {
+                const sync = JSON.parse(fs.readFileSync(syncPath, 'utf-8'));
+                if (typeof sync['workspace_id'] === 'string' && sync['workspace_id']) {
+                    resolvedWorkspaceId = sync['workspace_id'];
+                }
+            }
+        }
+        catch {
+            // Soft-coupled: ignore read errors; fall back to env.
+        }
+        this.workspaceId = resolvedWorkspaceId;
+    }
+    /**
+     * Resolve the workspace ID:
+     *   1. Read workspace_id from <rootDir>/.tacit/sync.json if the file exists.
+     *   2. Fall back to TACIT_WORKSPACE_ID env var.
+     *   3. Return null if neither source is available.
+     */
+    async resolveWorkspaceId() {
+        try {
+            const syncPath = path.join(this._rootDir, '.tacit', 'sync.json');
+            if (fs.existsSync(syncPath)) {
+                const sync = JSON.parse(fs.readFileSync(syncPath, 'utf-8'));
+                if (typeof sync['workspace_id'] === 'string' && sync['workspace_id']) {
+                    return sync['workspace_id'];
+                }
+            }
+        }
+        catch {
+            // Soft-coupled: ignore read errors; fall back to env.
+        }
+        const envId = process.env['TACIT_WORKSPACE_ID'];
+        return (envId && envId.length > 0) ? envId : null;
+    }
+    /** Build auth headers. Value is NEVER written to logs. */
+    authHeaders() {
+        const headers = {
+            'Content-Type': 'application/json',
+        };
+        if (this.token) {
+            // Authorization header value intentionally excluded from all logging paths.
+            headers['Authorization'] = `Bearer ${this.token}`;
+        }
+        return headers;
+    }
+    /** GET request returning parsed JSON. */
+    async get(endpoint, params) {
+        const url = new URL(`${this.apiUrl}${endpoint}`);
+        if (params) {
+            for (const [k, v] of Object.entries(params)) {
+                if (v !== undefined)
+                    url.searchParams.set(k, String(v));
+            }
+        }
+        const res = await this._fetch(url.toString(), {
+            method: 'GET',
+            headers: this.authHeaders(),
+        });
+        if (!res.ok) {
+            const body = await res.text().catch(() => '');
+            throw new TacitApiError(res.status, body, endpoint);
+        }
+        return res.json();
+    }
+    /** POST request returning parsed JSON. */
+    async post(endpoint, body) {
+        const res = await this._fetch(`${this.apiUrl}${endpoint}`, {
+            method: 'POST',
+            headers: this.authHeaders(),
+            body: JSON.stringify(body),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => '');
+            throw new TacitApiError(res.status, text, endpoint);
+        }
+        return res.json();
+    }
+    /** PATCH request returning parsed JSON. */
+    async patch(endpoint, body) {
+        const res = await this._fetch(`${this.apiUrl}${endpoint}`, {
+            method: 'PATCH',
+            headers: this.authHeaders(),
+            body: JSON.stringify(body),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => '');
+            throw new TacitApiError(res.status, text, endpoint);
+        }
+        return res.json();
+    }
+    /**
+     * POST to an SSE endpoint, returning an async generator of text chunks.
+     * The Authorization header value is never written to process.stderr or stdout.
+     */
+    async *postSSE(endpoint, body) {
+        const res = await this._fetch(`${this.apiUrl}${endpoint}`, {
+            method: 'POST',
+            headers: {
+                ...this.authHeaders(),
+                'Accept': 'text/event-stream',
+            },
+            body: JSON.stringify(body),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => '');
+            throw new TacitApiError(res.status, text, endpoint);
+        }
+        if (!res.body) {
+            throw new Error('SSE response has no body');
+        }
+        const reader = res.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = '';
+        try {
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                buffer += decoder.decode(value, { stream: true });
+                const lines = buffer.split('\n');
+                buffer = lines.pop() ?? '';
+                for (const line of lines) {
+                    if (line.startsWith('data: ')) {
+                        const data = line.slice(6).trim();
+                        if (data === '[DONE]')
+                            return;
+                        if (data)
+                            yield data;
+                    }
+                }
+            }
+            // Flush remaining buffer
+            if (buffer.startsWith('data: ')) {
+                const data = buffer.slice(6).trim();
+                if (data && data !== '[DONE]')
+                    yield data;
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+    }
+    /** POST multipart form data (for file ingest). */
+    async postFormData(endpoint, formData) {
+        // Build headers without Content-Type (let fetch set multipart boundary).
+        const headers = {};
+        if (this.token) {
+            headers['Authorization'] = `Bearer ${this.token}`;
+        }
+        const res = await this._fetch(`${this.apiUrl}${endpoint}`, {
+            method: 'POST',
+            headers,
+            body: formData,
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => '');
+            throw new TacitApiError(res.status, text, endpoint);
+        }
+        return res.json();
+    }
+}
+exports.TacitClient = TacitClient;
+class TacitApiError extends Error {
+    statusCode;
+    body;
+    endpoint;
+    constructor(statusCode, body, endpoint) {
+        super(`Tacit API error ${statusCode} on ${endpoint}`);
+        this.statusCode = statusCode;
+        this.body = body;
+        this.endpoint = endpoint;
+        this.name = 'TacitApiError';
+    }
+}
+exports.TacitApiError = TacitApiError;
+/** Shared singleton client (initialized lazily on first use). */
+let _defaultClient = null;
+function getClient() {
+    if (!_defaultClient) {
+        _defaultClient = new TacitClient();
+    }
+    return _defaultClient;
+}

package/dist/index.d.ts

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+/**
+ * @tacit/mcp-server — stdio MCP server
+ *
+ * Transport: StdioServerTransport (NOT HTTP).
+ * Per-cell invariant: spawned once per IDE session per user; never a daemon.
+ * No network listener. All egress goes through TACIT_API_URL only.
+ *
+ * Security invariants:
+ *   - No anthropic/openai import.
+ *   - TACIT_TOKEN never logged.
+ *   - Token from env only.
+ *
+ * Compatibility guard (D-7 / KR4):
+ *   Reads own package.json compatibility.coreArtifact (semver range).
+ *   If TACIT_CORE_VERSION env is set, checks range; exits non-zero on mismatch.
+ *   Prints COMPAT_RANGE: <range> on startup for oracle D4.
+ *
+ * setup subcommand stub (MV-1057h hook point):
+ *   `tacit-mcp-server setup` is reserved for MV-1057h setup wizard.
+ *   Currently prints a placeholder message and exits 0.
+ */
+export {};

package/dist/index.js

@@ -0,0 +1,168 @@
+#!/usr/bin/env node
+"use strict";
+// SPDX-License-Identifier: MIT
+/**
+ * @tacit/mcp-server — stdio MCP server
+ *
+ * Transport: StdioServerTransport (NOT HTTP).
+ * Per-cell invariant: spawned once per IDE session per user; never a daemon.
+ * No network listener. All egress goes through TACIT_API_URL only.
+ *
+ * Security invariants:
+ *   - No anthropic/openai import.
+ *   - TACIT_TOKEN never logged.
+ *   - Token from env only.
+ *
+ * Compatibility guard (D-7 / KR4):
+ *   Reads own package.json compatibility.coreArtifact (semver range).
+ *   If TACIT_CORE_VERSION env is set, checks range; exits non-zero on mismatch.
+ *   Prints COMPAT_RANGE: <range> on startup for oracle D4.
+ *
+ * setup subcommand stub (MV-1057h hook point):
+ *   `tacit-mcp-server setup` is reserved for MV-1057h setup wizard.
+ *   Currently prints a placeholder message and exits 0.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const index_js_1 = require("@modelcontextprotocol/sdk/server/index.js");
+const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
+const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+const semver = __importStar(require("semver"));
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+// Tool handlers
+const search_js_1 = require("./tools/search.js");
+const synthesize_js_1 = require("./tools/synthesize.js");
+const recall_js_1 = require("./tools/recall.js");
+const artifacts_js_1 = require("./tools/artifacts.js");
+const ingest_js_1 = require("./tools/ingest.js");
+// Setup wizard (MV-1057h)
+const setup_js_1 = require("./setup.js");
+// ─── Compatibility guard ──────────────────────────────────────────────────────
+function checkCompatibility() {
+    const pkgPath = path.join(__dirname, '..', 'package.json');
+    let pkg = {};
+    try {
+        pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+    }
+    catch {
+        // Non-fatal if package.json cannot be read at runtime.
+        return;
+    }
+    const compat = pkg['compatibility'];
+    const coreArtifactRange = compat?.['coreArtifact'];
+    if (typeof coreArtifactRange === 'string') {
+        // Print range for oracle D4 grep.
+        process.stderr.write(`COMPAT_RANGE: ${coreArtifactRange}\n`);
+        const coreVersion = process.env['TACIT_CORE_VERSION'];
+        if (coreVersion) {
+            const valid = semver.satisfies(coreVersion, coreArtifactRange, { includePrerelease: false });
+            if (!valid) {
+                process.stderr.write(`ERROR: TACIT_CORE_VERSION=${coreVersion} does not satisfy compatibility.coreArtifact range ${coreArtifactRange}\n`);
+                process.stderr.write(`This version of @tacit/mcp-server requires core artifact version in range: ${coreArtifactRange}\n`);
+                process.exit(1);
+            }
+        }
+    }
+}
+// ─── Tool registry ────────────────────────────────────────────────────────────
+const TOOLS = [
+    search_js_1.SEARCH_TOOL_DEF,
+    synthesize_js_1.SYNTHESIZE_TOOL_DEF,
+    recall_js_1.RECALL_TOOL_DEF,
+    artifacts_js_1.ARTIFACT_LIST_TOOL_DEF,
+    artifacts_js_1.ARTIFACT_CREATE_TOOL_DEF,
+    artifacts_js_1.ARTIFACT_UPDATE_TOOL_DEF,
+    artifacts_js_1.ARTIFACT_PUBLISH_TOOL_DEF,
+    ingest_js_1.INGEST_FILE_TOOL_DEF,
+    ingest_js_1.INGEST_URL_TOOL_DEF,
+];
+async function dispatchTool(name, args) {
+    switch (name) {
+        case 'tacit_search':
+            return (0, search_js_1.handleSearch)(args);
+        case 'tacit_synthesize':
+        case 'tacit_ask':
+        case 'tacit_compose':
+            return (0, synthesize_js_1.handleSynthesize)(args);
+        case 'tacit_recall':
+            return (0, recall_js_1.handleRecall)(args);
+        case 'tacit_artifact_list':
+            return (0, artifacts_js_1.handleArtifactList)(args);
+        case 'tacit_artifact_create':
+            return (0, artifacts_js_1.handleArtifactCreate)(args);
+        case 'tacit_artifact_update':
+            return (0, artifacts_js_1.handleArtifactUpdate)(args);
+        case 'tacit_artifact_publish':
+            return (0, artifacts_js_1.handleArtifactPublish)(args);
+        case 'tacit_ingest_file':
+            return (0, ingest_js_1.handleIngestFile)(args);
+        case 'tacit_ingest_url':
+            return (0, ingest_js_1.handleIngestUrl)(args);
+        default:
+            return {
+                content: [{ type: 'text', text: `Unknown tool: ${name}` }],
+                isError: true,
+            };
+    }
+}
+// ─── Main ─────────────────────────────────────────────────────────────────────
+async function run() {
+    // Handle setup subcommand before starting stdio transport (MV-1057h).
+    if (process.argv[2] === 'setup') {
+        await (0, setup_js_1.setup)(process.argv.slice(3));
+        return;
+    }
+    // Compatibility guard — exits non-zero on version mismatch.
+    checkCompatibility();
+    const server = new index_js_1.Server({ name: '@tacit/mcp-server', version: '0.1.0' }, { capabilities: { tools: {} } });
+    // tools/list
+    server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => ({
+        tools: TOOLS,
+    }));
+    // tools/call
+    server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
+        const { name, arguments: args } = request.params;
+        const result = await dispatchTool(name, args ?? {});
+        return result;
+    });
+    // Wire stdio transport — NOT an HTTP server (D-4/D-10).
+    const transport = new stdio_js_1.StdioServerTransport();
+    await server.connect(transport);
+}
+run().catch((err) => {
+    process.stderr.write(`tacit-mcp-server fatal: ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(1);
+});

package/dist/setup.d.ts

@@ -0,0 +1,18 @@
+/**
+ * setup — wizard subcommand for @tacit/mcp-server
+ *
+ * Usage:
+ *   node dist/index.js setup [--dry-run] [--api-url <url>] [--token <token>] [--smoke]
+ *
+ * Contract (§2.1 of sparc_specification.md, Phase-2 QE resolutions):
+ *   F1 smoke   — calls tacit_synthesize via getClient()/postSSE; exits non-zero on empty/error.
+ *   F2 env-ref — writes TACIT_TOKEN as the LITERAL placeholder "${TACIT_TOKEN}" (never the real value).
+ *   Merge      — deep-merges ONLY mcpServers.tacit; all other keys preserved.
+ *   Idempotent — same --api-url → byte-identical mcp.json.
+ *   Secrets    — token NEVER written to any output stream.
+ *
+ * Security invariants:
+ *   - Token is NEVER logged or written to disk.
+ *   - Authorization header value excluded from all logging paths.
+ */
+export declare function setup(argv: string[]): Promise<void>;