@wcag-checkr/mcp 1.0.0-rc.98 → 1.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wcag-checkr/mcp",
-  "version": "1.0.0-rc.98",
+  "version": "1.0.0",
   "private": false,
   "description": "Model Context Protocol server for wcagcheckr. Lets LLM-IDEs (Claude Code, Cursor, Continue, etc.) drive accessibility audits, verify forensic receipts, and look up tier features programmatically. Same audit engine as the Chrome extension and CI runner.",
   "license": "UNLICENSED",

package/wcagcheckr-mcp.mjs

@@ -77,6 +77,13 @@ const TOOLS = [
           type: 'number',
           description: 'Audit timeout in milliseconds. Default: 120000.',
         },
+        license: {
+          type: 'string',
+          description:
+            'wcagcheckr license token. Required during the private build phase (team license only). ' +
+            'Falls back to WCAGCHECKR_LICENSE environment variable if omitted. ' +
+            'Email cliff@locustware.com for beta access.',
+        },
       },
       required: ['url'],
     },
@@ -124,10 +131,27 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
 // ─── Tool implementations ────────────────────────────────────────────────────
 
 async function auditUrl(args) {
-  const { url, format = 'json', threshold = 'serious', timeout_ms = 120_000 } = args;
+  const { url, format = 'json', threshold = 'serious', timeout_ms = 120_000, license } = args;
   if (!url) {
     return { isError: true, content: [{ type: 'text', text: 'Missing required field: url' }] };
   }
+  // rc.124 — Headless-build lockdown gate. License required during private
+  // build. Accept from tool args first, fall back to WCAGCHECKR_LICENSE env.
+  const licenseToken = license ?? process.env.WCAGCHECKR_LICENSE;
+  if (!licenseToken) {
+    return {
+      isError: true,
+      content: [
+        {
+          type: 'text',
+          text:
+            'wcagcheckr is in private build phase. A team license is required. ' +
+            'Pass `license: "<token>"` in the audit_url args OR set WCAGCHECKR_LICENSE in your environment. ' +
+            'Email cliff@locustware.com for beta access.',
+        },
+      ],
+    };
+  }
   if (!existsSync(CI_RUNNER_PATH)) {
     return {
       isError: true,
@@ -139,12 +163,41 @@ async function auditUrl(args) {
       ],
     };
   }
+  // rc.342 — Per-feature tier gate. Hit the license validate endpoint
+  // directly to read the features blob; refuse if mcpServer is explicitly
+  // disabled. `features.mcpServer === undefined` falls through as permissive.
+  try {
+    const validateRes = await fetch(`${SERVER_BASE_URL}/v1/products/wcagcheckr/license/validate`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ token: licenseToken }),
+    });
+    if (validateRes.ok) {
+      const body = await validateRes.json();
+      if (body?.features && body.features.mcpServer === false) {
+        return {
+          isError: true,
+          content: [{
+            type: 'text',
+            text: 'wcagcheckr MCP server is not available on your current plan. Upgrade at https://wcagcheckr.com/pricing.',
+          }],
+        };
+      }
+    }
+    // Non-ok or parse failure: fall through. The CLI delegate will fail
+    // license validation itself if the token is bad; per-feature gating
+    // requires a successful validate, so a network glitch shouldn't lock
+    // out a paying customer.
+  } catch {
+    /* swallow — same fall-through rationale */
+  }
 
   return new Promise((resolveResult) => {
     const args = [
       CI_RUNNER_PATH,
       'audit',
       url,
+      '--license', licenseToken,
       '--format', format,
       '--threshold', threshold,
       '--timeout', String(timeout_ms),