@urbicon-ui/mcp-server 6.48.1 → 6.50.0

package/README.md

@@ -9,7 +9,9 @@ Model Context Protocol server for the Urbicon UI design system. Gives LLMs first
 > bundle (`@urbicon-ui/design-content`), kept for the launch decision of hosting a public
 > endpoint (evaluation/reach: "point your agent at Urbicon without installing anything").
 > It is deliberately absent from the public docs until that endpoint exists, and a local
-> install is **not** a supported consumer path (see docs/internal/DESIGN-MCP-V2.md §11).
+> install is **not** a supported consumer path: manifest read/write is a working-directory
+> concern and lives in the CLI, so a locally installed copy of this stateless server would
+> offer strictly less than the dev-dependency it duplicates.
 
 **Transports:** stdio (default, for in-repo development) and streamable HTTP (the intended remote deployment).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@urbicon-ui/mcp-server",
-  "version": "6.48.1",
+  "version": "6.50.0",
   "description": "Model Context Protocol server exposing the Urbicon UI component catalog, recipes and design intelligence to LLM agents",
   "license": "MIT",
   "repository": {
@@ -39,8 +39,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@urbicon-ui/design-content": "6.48.1",
-    "@urbicon-ui/design-engine": "6.48.1",
+    "@urbicon-ui/design-content": "6.50.0",
+    "@urbicon-ui/design-engine": "6.50.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {

package/src/index.ts

@@ -8,13 +8,20 @@ import { startStdioTransport } from './transports/stdio.js';
 interface CliArgs {
   transport: 'stdio' | 'http';
   port: number;
+  host: string;
   contentDir?: string;
 }
 
 function parseArgs(args: string[]): CliArgs {
   const result: CliArgs = {
     transport: 'stdio',
-    port: 3001
+    port: 3001,
+    // Loopback by default: this server has no authentication of its own and is
+    // meant to sit behind a reverse proxy. Binding every interface was the old
+    // behaviour — the deploy host set `HOST=127.0.0.1` for years and nothing
+    // read it, so the listener answered on `0.0.0.0` and only the firewall kept
+    // it private. Widening this is now a deliberate `--host 0.0.0.0`.
+    host: process.env.HOST ?? '127.0.0.1'
   };
 
   for (let i = 0; i < args.length; i++) {
@@ -29,6 +36,9 @@ function parseArgs(args: string[]): CliArgs {
     } else if (arg === '--port' && next) {
       result.port = parseInt(next, 10);
       i++;
+    } else if (arg === '--host' && next) {
+      result.host = next;
+      i++;
     } else if (arg === '--content-dir' && next) {
       result.contentDir = next;
       i++;
@@ -53,7 +63,7 @@ async function main(): Promise<void> {
   }
 
   if (args.transport === 'http') {
-    await startHttpTransport(args.port);
+    await startHttpTransport(args.port, args.host);
   } else {
     const server = createServer();
     await startStdioTransport(server);

package/src/tools/get-checklist.ts

@@ -93,7 +93,7 @@ export function registerGetChecklistTool(server: McpServer): void {
       md +=
         '- [ ] Spacing varies: tight (`gap-2`/`gap-3`) within related items, generous (`gap-8`/`gap-10`) between sections — not uniform everywhere\n';
       md +=
-        "- [ ] Border-radius follows a deliberate strategy — overridden via `class` or `slotClasses` where component defaults don't match the design identity\n";
+        '- [ ] Shape is decided at the tier, not per element — if the default family radii don\'t match the design identity, retune `--radius-commit`/`-modify`/`-contain` together in the theme (containers never tighter than what sits inside them). A `class="rounded-*"` on a single component splits its family\n';
       md +=
         '- [ ] Data-driven styling: different states/severities are visually distinct through padding, font-weight, Badge `variant`, and text color — not just labels\n';
       md +=

package/src/transports/http.ts

@@ -26,11 +26,16 @@ function respondError(res: ServerResponse, status: number, code: number, message
  * server that offers no sessions. Any non-`/mcp` path returns a plain-text
  * banner (a lightweight liveness ping).
  *
- * @param port - TCP port to listen on (binds `http://localhost:<port>/mcp`).
+ * @param port - TCP port to listen on (binds `http://<host>:<port>/mcp`).
+ * @param host - Interface to bind. Defaults to loopback: the server has no auth
+ *   of its own and belongs behind a reverse proxy. Pass `0.0.0.0` to widen it.
  * @returns A stop handle; `index.ts` ignores it and runs until the process
  *   exits, the transport test uses it to shut the listener down.
  */
-export async function startHttpTransport(port: number): Promise<{ close: () => Promise<void> }> {
+export async function startHttpTransport(
+  port: number,
+  host = '127.0.0.1'
+): Promise<{ close: () => Promise<void> }> {
   const httpServer = createHttpServer(async (req, res) => {
     const url = new URL(req.url || '/', `http://localhost:${port}`);
 
@@ -74,8 +79,8 @@ export async function startHttpTransport(port: number): Promise<{ close: () => P
   });
 
   await new Promise<void>((resolve) => {
-    httpServer.listen(port, () => {
-      console.error(`Urbicon UI MCP Server listening on http://localhost:${port}/mcp`);
+    httpServer.listen(port, host, () => {
+      console.error(`Urbicon UI MCP Server listening on http://${host}:${port}/mcp`);
       resolve();
     });
   });