@younndai/lyt-mcp 0.12.1 → 0.13.1

package/CONTRIBUTING.md

@@ -0,0 +1,61 @@
+# Contributing to Lyt (Link Your Think™)
+
+Thank you for your interest in contributing to Lyt, a YounndAI™ product by
+MARLINK TRADING SRL.
+
+> Lyt is in public **alpha**. The surface is moving quickly; please open an
+> issue or a discussion before starting non-trivial work so we can confirm
+> direction and avoid duplicated effort.
+
+## Contributor License Agreement (REQUIRED)
+
+Before we can accept your contribution, we need you to sign a Contributor
+License Agreement (CLA). The CLA is a one-time legal document that confirms:
+
+- You have the right to grant us the license terms specified in the CLA
+- You grant us a broad, perpetual license to use, modify, and re-license your contribution
+- You receive no special contributor rights: no royalties, governance, trademark rights, private license-back, approval rights, or claims against future relicensing or posture changes
+- Your contribution is provided "as is" without warranty
+
+### Which CLA do I sign?
+
+- **[Individual CLA](https://github.com/YounndAI/lyt/blob/main/CLA.md)** — if you are
+  contributing on your own behalf, on your own time, and your employer has no
+  claim to your intellectual-property output.
+- **[Entity CLA](https://github.com/YounndAI/lyt/blob/main/CLA-entity.md)** — if you are
+  contributing as an employee or contractor on behalf of an employer or
+  organization. The Entity CLA covers all contributors your organization
+  authorizes (listed in its Schedule A).
+
+If you are unsure, sign **both**.
+
+### How to sign
+
+When you open your first pull request, our [CLA bot](https://cla-assistant.io)
+will comment with a link to sign. You can sign electronically via GitHub OAuth
+— no paperwork required. Once signed, your future contributions are
+automatically covered. **Pull requests cannot be merged until the CLA bot
+confirms a signed CLA is on file for all contributors.**
+
+## Code contribution checklist
+
+- [ ] Signed the appropriate CLA (see above)
+- [ ] Apache-2.0 copyright header included in any new source files (see existing files for the exact block)
+- [ ] Code follows existing project conventions (TypeScript strict mode, libSQL-only data layer, cross-platform paths)
+- [ ] Focused tests added for new functionality; `npm run build`, `npm run typecheck`, and `npm test` green
+- [ ] Documentation updated for user-facing changes
+- [ ] Trademark indicators (™) on first prominent use of any YounndAI or Lyt mark in new documentation
+- [ ] CHANGELOG.md updated where the change is user-facing
+
+## Code of conduct
+
+We follow the [Contributor Covenant Code of Conduct](https://github.com/YounndAI/lyt/blob/main/CODE_OF_CONDUCT.md).
+By contributing, you agree to abide by its terms.
+
+## Questions?
+
+- General questions: [GitHub Discussions](https://github.com/YounndAI/lyt/discussions)
+- Legal questions: office@younndai.com
+- Security questions: see [SECURITY.md](SECURITY.md)
+
+Thank you for contributing!

package/NOTICE

@@ -12,12 +12,12 @@ Licensed under the Apache License, Version 2.0. See LICENSE.
 Trademark notice
 ----------------------------------------------------------------------
 
-YounndAI™ and LYT™ are trademarks of MARLINK TRADING SRL.
+YounndAI™ and Lyt (Link Your Think™) are trademarks of MARLINK TRADING SRL.
 
 The Apache License, Version 2.0 does not grant permission to use the
 trade names, trademarks, service marks, or product names of
 MARLINK TRADING SRL, except as required for describing the origin of
 this work and reproducing the content of this NOTICE file.
 
-See TRADEMARK.md for the trademark usage policy.
+See https://github.com/YounndAI/lyt/blob/main/TRADEMARK.md for the trademark usage policy.
 For trademark usage permissions, contact: office@younndai.com

package/README.md

@@ -9,7 +9,7 @@
 <p align="center">
   <strong>@younndai/lyt-mcp</strong><br />
   The MCP server — your markdown vaults and meshes as Model Context Protocol tools, local and typed.<br />
-  <em>Part of the Lyt™ toolchain — federated markdown vaults you own, made legible to AI.</em>
+  <em>Part of the Lyt (Link Your Think™) toolchain — federated markdown vaults you own, made legible to AI.</em>
 </p>
 
 <p align="center">
@@ -24,7 +24,7 @@
 
 ## What is this?
 
-`@younndai/lyt-mcp` is a [Model Context Protocol](https://modelcontextprotocol.io) server that exposes the [Lyt™](https://github.com/YounndAI/lyt) vault and mesh operation set as **typed MCP tools**. Any MCP-compatible client — Claude Desktop, Claude Code, Codex, or your own agent runtime — can search, read, and operate your markdown vaults **locally**, over stdio, with no separate CLI subprocess per call and no cloud middleman. Your knowledge never leaves your machine; the agent comes to the data.
+`@younndai/lyt-mcp` is a [Model Context Protocol](https://modelcontextprotocol.io) server that exposes the [Lyt](https://github.com/YounndAI/lyt) vault and mesh operation set as **typed MCP tools**. Any MCP-compatible client — Claude Desktop, Claude Code, Codex, or your own agent runtime — can search, read, and operate your markdown vaults **locally**, over stdio, with no separate CLI subprocess per call and no cloud middleman. Your knowledge never leaves your machine; the agent comes to the data.
 
 This is Lyt's **AI-first** contract made protocol-native: the same governed operations available as `lyt vault ...` / `lyt mesh ...` on the command line are surfaced as MCP tools with [Zod](https://zod.dev)-validated schemas, so agents get accurate parameter validation and structured errors instead of scraping CLI text. One operation set, three transports — CLI for you, MCP for your agents, harness skills for agent runtimes without MCP.
 

package/SECURITY.md

@@ -0,0 +1,45 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+If you discover a security vulnerability in Lyt, please report it
+responsibly:
+
+1. **DO NOT** file a public GitHub issue.
+2. Email **office@younndai.com** with:
+   - A description of the vulnerability and its potential impact
+   - Steps to reproduce, or a proof of concept (if safe to share)
+   - Affected versions
+   - Suggested severity: **Critical**, **High**, or **Moderate**
+
+Responsible disclosure preserves the safety of every downstream user.
+
+## Response timeline
+
+| Action                  | SLA              |
+| ----------------------- | ---------------- |
+| Acknowledgement         | 72 hours         |
+| Initial assessment      | 7 calendar days  |
+| Remediation or advisory | 30 calendar days |
+
+Critical issues are prioritized and may be patched ahead of the stated window
+where feasible.
+
+## Supported versions
+
+Lyt is in public **alpha**. Security fixes are applied to the latest published
+`alpha` release only. Pin to a released version and update promptly when a new
+alpha ships.
+
+## Responsible disclosure
+
+We commit to:
+
+- Acknowledging your report within the timeline above
+- Working with you to verify and reproduce the vulnerability
+- Coordinating a public disclosure date that gives users time to update
+- Crediting you in the security advisory (unless you prefer anonymity)
+
+---
+
+© 2026 MARLINK TRADING SRL (YounndAI).

package/dist/cli.js

@@ -1,4 +1,19 @@
 #!/usr/bin/env node
+/*
+ * Copyright 2026 MARLINK TRADING SRL (YounndAI)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { buildMcpSubcommand } from "./mcp-command.js";

package/dist/errors.js

@@ -1,3 +1,18 @@
+/*
+ * Copyright 2026 MARLINK TRADING SRL (YounndAI)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 const GENERIC_CLIENT_ERROR = "lyt-mcp: an internal error occurred.";
 function leaksInternalDetail(message) {
     return (/[A-Za-z]:[\\/]/.test(message) ||

package/dist/generate-tools.js

@@ -1,3 +1,18 @@
+/*
+ * Copyright 2026 MARLINK TRADING SRL (YounndAI)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 const CALLER_SETTABLE_GATE_FIELD = "confirmed";
 const SAFE_UNGATED_WRITE_OPS = new Set([
     "vault.reconnect",

package/dist/index.js

@@ -1,3 +1,18 @@
+/*
+ * Copyright 2026 MARLINK TRADING SRL (YounndAI)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 export { buildMcpSubcommand } from "./mcp-command.js";
 export { buildLytMcpServer, startStdioServer, SERVER_NAME, SERVER_VERSION } from "./server.js";
 export { buildOpRegistry } from "./registry.js";

package/dist/mcp-command.js

@@ -1,3 +1,18 @@
+/*
+ * Copyright 2026 MARLINK TRADING SRL (YounndAI)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import { Command } from "commander";
 import { startStdioServer } from "./server.js";
 export function buildMcpSubcommand() {

package/dist/registry.js

@@ -1,3 +1,18 @@
+/*
+ * Copyright 2026 MARLINK TRADING SRL (YounndAI)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import { z } from "zod";
 import { abandonVaultFlow, generatePrimerFlow, infoVaultFlow, listVaultsFlow, patternRunFlow, reconnectVaultFlow, searchCascadeFlow, shareVaultFlow, syncMetadataFlow, unshareVaultFlow, vaultAccessFlow, vaultInvitesFlow, verifyVaultsFlow, } from "@younndai/lyt-vault";
 import { addSource, listSources, parseScope, removeSource, serializeScope, withRegistry, } from "@younndai/lyt-mesh";

package/dist/server.js

@@ -1,3 +1,18 @@
+/*
+ * Copyright 2026 MARLINK TRADING SRL (YounndAI)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import { readFileSync } from "node:fs";
 import { resolve as pathResolve } from "node:path";
 import { fileURLToPath } from "node:url";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@younndai/lyt-mcp",
-  "version": "0.12.1",
+  "version": "0.13.1",
   "description": "Lyt MCP server — exposes the lyt-vault + lyt-mesh operation set as typed Model Context Protocol tools so AI agents (Claude Desktop, Claude Code, Codex, any MCP client) can drive Lyt locally.",
   "homepage": "https://linkyourthink.com",
   "repository": {
@@ -39,10 +39,12 @@
     "dist",
     "README.md",
     "LICENSE",
-    "NOTICE"
+    "NOTICE",
+    "CONTRIBUTING.md",
+    "SECURITY.md"
   ],
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && node ../../scripts/public-release/stamp-dist-license-headers.mjs",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
@@ -52,8 +54,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@younndai/lyt-mesh": "^0.12.1",
-    "@younndai/lyt-vault": "^0.12.1",
+    "@younndai/lyt-mesh": "^0.13.1",
+    "@younndai/lyt-vault": "^0.13.1",
     "commander": "^12.1.0",
     "zod": "^3.25.0"
   },