agent-discover 1.0.31 → 1.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +25 -0
- package/README.md +31 -13
- package/agent-desk-plugin.json +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [1.1.0] - 2026-04-08
|
|
9
|
+
|
|
10
|
+
Federated marketplace release: `/api/browse` now spans the official MCP registry, npm, and PyPI in one query, with cross-process activation, prereqs probing, and a `uvx` install path. Full UI/REST/MCP coverage.
|
|
11
|
+
|
|
12
|
+
### Added
|
|
13
|
+
|
|
14
|
+
- **PyPI marketplace integration.** `MarketplaceClient.searchPypi()` resolves a curated list of well-known Python MCP servers (`mcp-server-fetch`, `mcp-server-git`, `mcp-server-time`, `mcp-server-postgres`, `mcp-server-sqlite`, `mcp-proxy`, `mcp-cli`, …) against the stable PyPI JSON API (`/pypi/<name>/json`) for live metadata, plus a best-effort HTML scrape of `pypi.org/search` to surface anything beyond the curated list. PyPI hits are tagged `runtime: python` and merged into `/api/browse` results alongside the official registry and npm.
|
|
15
|
+
- **npm search fallback in `/api/browse`.** Two parallel npm queries (`<query> keywords:mcp` and `<query> mcp`) merge + dedupe with the official-registry results. The first variant catches packages that opted into the `keywords:mcp` tag; the second catches packages like Microsoft's `@playwright/mcp` that have no `keywords` field at all. Filtered to entries mentioning `mcp` / `model context protocol` in name/keywords/description.
|
|
16
|
+
- **Federated dedupe with cross-source visibility.** Browse results are keyed by `<source>:<name>` (`registry:`, `npm:`, `pypi:`) so packages with colliding names across sources (e.g. `mcp-server-sqlite` exists on both npm and PyPI as different projects) all stay visible, while same-source version duplicates still collapse (highest semver wins).
|
|
17
|
+
- **uvx install path in the dashboard.** The Browse-tab Install button now branches on `pkg.runtime === 'python'` (or `registry_name === 'pypi'`) and posts `command: 'uvx'`, `args: ['<pkg>']`, `tags: ['marketplace', 'pypi']`. The async pre-download path (`POST /api/servers`) and the explicit `POST /api/servers/:id/preinstall` endpoint both grew a `uv tool install <pkg>` branch alongside the existing `npm cache add`.
|
|
18
|
+
- **Prereqs probe (`GET /api/prereqs`).** Spawns `npx --version`, `uvx --version`, `docker --version`, `uv --version` using `spawn` with `shell: true` so Windows `.cmd` shims resolve. Returns `{ npx, uvx, docker, uv }`. The dashboard fetches it on load and renders an orange banner above the Browse list when something needed for an install is missing, with install hints linking to nodejs.org / docs.astral.sh/uv.
|
|
19
|
+
- **README/CHANGELOG/USER-MANUAL/API/ARCHITECTURE/DASHBOARD docs** brought fully up to date for the new federated marketplace, hydration, prereqs, and uvx flow.
|
|
20
|
+
|
|
21
|
+
### Fixed
|
|
22
|
+
|
|
23
|
+
- **Cross-process activation hydration.** Removed the `UPDATE servers SET active = 0` startup wipe in `context.ts`. Each fresh agent-discover process now reads `WHERE active = 1 AND installed = 1` and re-activates those servers in its own `McpProxy` on boot, with stale entries (failed activate) cleared back to `active = 0` so we don't retry forever. Activation lives in-memory in `McpProxy.activeServers` but the DB-backed `active` flag is the cross-process source of truth, so a tool activated via the dashboard UI is now visible to a freshly-spawned MCP client process without manual re-activation.
|
|
24
|
+
- **Scoped npm names rejected by server-name validation.** The Browse-tab install path sanitised `@scope/pkg` → `@scope-pkg`, leaving the leading `@` which fails the registry's `^[a-zA-Z0-9]…$` regex with HTTP 422. Now strips `@` to match the parallel `__installFromNpm` path. Confirmed via Playwright e2e against `@modelcontextprotocol/server-everything`.
|
|
25
|
+
- **Marketplace version-duplicates.** `parseResponse` now collapses one-row-per-version results from the official registry (`playwright-wizard-mcp ×3` → `×1`).
|
|
26
|
+
|
|
27
|
+
### Security
|
|
28
|
+
|
|
29
|
+
- **CRLF header injection in proxy secret merge.** When activating an SSE / streamable-http remote server, secrets stored for that server are merged into the outbound HTTP headers (`Authorization`, `API_KEY`, plus pass-through). Values containing `\r` or `\n` are now rejected before insertion to prevent HTTP header injection from a poisoned secret value. (`src/domain/proxy.ts`)
|
|
30
|
+
|
|
31
|
+
[Note: 1.0.28 – 1.0.31 were intermediate dev tags during this work and have been folded into 1.1.0 for the public release.]
|
|
32
|
+
|
|
8
33
|
## [1.0.27] - 2026-04-08
|
|
9
34
|
|
|
10
35
|
### Documentation
|
package/README.md
CHANGED
|
@@ -2,12 +2,14 @@
|
|
|
2
2
|
|
|
3
3
|
[](LICENSE)
|
|
4
4
|
[](https://nodejs.org/)
|
|
5
|
-
[]()
|
|
6
|
+
[]()
|
|
7
|
+
[]()
|
|
8
8
|
|
|
9
9
|
**MCP server registry and marketplace.** Discover, install, activate, and manage MCP tools on demand. Acts as a dynamic proxy -- activated servers have their tools merged into the registry's own tool list, so agents can use them without restarting.
|
|
10
10
|
|
|
11
|
+
Search spans the **official MCP registry**, **npm**, and **PyPI** in one query, so popular servers that aren't in the official index (Microsoft `@playwright/mcp`, `@modelcontextprotocol/server-*`, `mcp-server-fetch`, `mcp-server-git`, …) all show up.
|
|
12
|
+
|
|
11
13
|
Built for AI coding agents (Claude Code, Codex CLI, Gemini CLI, Aider) but works equally well with any MCP client, REST consumer, or WebSocket listener.
|
|
12
14
|
|
|
13
15
|
---
|
|
@@ -36,15 +38,19 @@ Static MCP configs mean every server is always running, even when unused. Adding
|
|
|
36
38
|
## Features
|
|
37
39
|
|
|
38
40
|
- **Local registry** -- register MCP servers in a SQLite database with name, command, args, env, tags
|
|
39
|
-
- **
|
|
40
|
-
- **
|
|
41
|
+
- **Federated marketplace search** -- a single query hits the official MCP registry, npm, and PyPI in parallel, dedupes by `<source>:<name>`, and collapses version duplicates
|
|
42
|
+
- **PyPI integration** -- curated list of well-known Python MCP servers (`mcp-server-fetch`, `mcp-server-git`, `mcp-server-time`, `mcp-server-postgres`, `mcp-server-sqlite`, `mcp-proxy`, …) plus live metadata via the PyPI JSON API; Python entries install via `uvx`
|
|
43
|
+
- **npm fallback** -- two parallel npm searches (`keywords:mcp` and `<query> mcp`) catch packages that didn't tag themselves (e.g. Microsoft `@playwright/mcp`)
|
|
44
|
+
- **Prereqs probe** -- `GET /api/prereqs` reports which package managers (`npx`, `uvx`, `docker`, `uv`) are available on the host; the dashboard surfaces a banner when something needed for an install is missing
|
|
45
|
+
- **Cross-process activation** -- the `active` flag is the source of truth in SQLite; every fresh agent-discover process hydrates its in-memory proxy from the DB on startup, so tools activated in one process show up in others
|
|
46
|
+
- **On-demand activation** -- activate/deactivate servers at runtime; their tools appear and disappear dynamically with `tools/list_changed` notifications
|
|
41
47
|
- **Tool proxying** -- activated server tools are namespaced as `serverName__toolName` and merged into the tool list
|
|
42
|
-
- **Multi-transport** --
|
|
43
|
-
- **Secret management** -- store API keys and tokens per server, automatically injected as env vars (stdio) or HTTP headers (SSE/streamable-http) on activation
|
|
48
|
+
- **Multi-transport** -- stdio, SSE, and streamable-http transports for connecting to child servers
|
|
49
|
+
- **Secret management** -- store API keys and tokens per server, automatically injected as env vars (stdio) or HTTP headers (SSE/streamable-http) on activation; CRLF-validated to prevent header injection
|
|
44
50
|
- **Health checks** -- connect/disconnect probes for inactive servers, tool-list checks for active ones, with error count tracking
|
|
45
51
|
- **Per-tool metrics** -- call counts, error counts, and average latency recorded automatically on every proxied tool call
|
|
46
52
|
- **Full-text search** -- FTS5 search across server names, descriptions, and tags
|
|
47
|
-
- **
|
|
53
|
+
- **Pre-download** -- fire-and-forget `npm cache add` (npx servers) or `uv tool install` (uvx servers) on registration, plus a dedicated `/preinstall` endpoint
|
|
48
54
|
- **Real-time dashboard** -- web UI at http://localhost:3424 with Servers and Browse tabs, dark/light theme, WebSocket updates
|
|
49
55
|
- **3 transport layers** -- MCP (stdio), REST API (HTTP), WebSocket (real-time events)
|
|
50
56
|
|
|
@@ -110,12 +116,13 @@ Activated servers expose their tools through agent-discover, namespaced as `serv
|
|
|
110
116
|
|
|
111
117
|
---
|
|
112
118
|
|
|
113
|
-
## REST API (
|
|
119
|
+
## REST API (19 endpoints)
|
|
114
120
|
|
|
115
121
|
All endpoints return JSON. CORS enabled.
|
|
116
122
|
|
|
117
123
|
```
|
|
118
124
|
GET /health Version, uptime
|
|
125
|
+
GET /api/prereqs Probe host for npx/uvx/docker/uv availability
|
|
119
126
|
GET /api/servers List servers (?query=, ?source=, ?installed=)
|
|
120
127
|
GET /api/servers/:id Server details + tools
|
|
121
128
|
POST /api/servers Register new server
|
|
@@ -123,14 +130,14 @@ PUT /api/servers/:id Update server config (description, com
|
|
|
123
130
|
DELETE /api/servers/:id Unregister (deactivates first if active)
|
|
124
131
|
POST /api/servers/:id/activate Activate -- start server, discover tools, begin proxying
|
|
125
132
|
POST /api/servers/:id/deactivate Deactivate -- stop server, remove tools
|
|
126
|
-
POST /api/servers/:id/preinstall Pre-download npx
|
|
133
|
+
POST /api/servers/:id/preinstall Pre-download package (npm cache add for npx, uv tool install for uvx)
|
|
127
134
|
GET /api/servers/:id/secrets List secrets (masked values)
|
|
128
135
|
PUT /api/servers/:id/secrets/:key Set a secret (upsert)
|
|
129
136
|
DELETE /api/servers/:id/secrets/:key Delete a secret
|
|
130
137
|
POST /api/servers/:id/health Run health check (connect/disconnect probe)
|
|
131
138
|
GET /api/servers/:id/metrics Per-tool metrics for a server (call count, errors, latency)
|
|
132
139
|
GET /api/metrics Metrics overview across all servers
|
|
133
|
-
GET /api/browse
|
|
140
|
+
GET /api/browse Federated search: official registry + npm + PyPI (?query=, ?limit=, ?cursor=)
|
|
134
141
|
GET /api/npm-check Check if an npm package exists (?package=)
|
|
135
142
|
GET /api/status Active servers summary (names, tool counts, tool lists)
|
|
136
143
|
```
|
|
@@ -143,7 +150,7 @@ The web dashboard auto-starts at **http://localhost:3424** and provides two view
|
|
|
143
150
|
|
|
144
151
|
**Servers tab** -- all registered servers as cards showing health dots, error counts, active/inactive status, description, tags, tools list, and expandable Secrets/Metrics/Config sections. Action buttons for activate, deactivate, health check, and delete.
|
|
145
152
|
|
|
146
|
-
**Browse tab** -- search the official MCP registry.
|
|
153
|
+
**Browse tab** -- federated search across the official MCP registry, npm, and PyPI. Each card shows the runtime tag (`node`, `python`, `streamable-http`, …), version, description, and an install button that picks the right command (`npx`, `uvx`, or remote URL) automatically. A prereq banner at the top of the tab warns when a required package manager (`npx`, `uvx`, `docker`) is missing on the host.
|
|
147
154
|
|
|
148
155
|
Real-time updates via WebSocket with 2-second database polling. Dark and light themes with persistent preference.
|
|
149
156
|
|
|
@@ -152,10 +159,11 @@ Real-time updates via WebSocket with 2-second database polling. Dark and light t
|
|
|
152
159
|
## Testing
|
|
153
160
|
|
|
154
161
|
```bash
|
|
155
|
-
npm test #
|
|
162
|
+
npm test # 151 tests across 8 files
|
|
156
163
|
npm run test:watch # Watch mode
|
|
157
164
|
npm run test:coverage # Coverage report
|
|
158
165
|
npm run check # Full CI: typecheck + lint + format + test
|
|
166
|
+
npm run test:e2e:ui # Playwright dashboard smoke tests
|
|
159
167
|
```
|
|
160
168
|
|
|
161
169
|
---
|
|
@@ -167,6 +175,16 @@ npm run check # Full CI: typecheck + lint + format + test
|
|
|
167
175
|
| `AGENT_DISCOVER_PORT` | `3424` | Dashboard HTTP port |
|
|
168
176
|
| `AGENT_DISCOVER_DB` | `~/.claude/agent-discover.db` | SQLite database path |
|
|
169
177
|
|
|
178
|
+
### Host package manager prerequisites
|
|
179
|
+
|
|
180
|
+
agent-discover spawns child MCP servers via the host's installed package managers. Install whatever you intend to use; missing tools are reported by `GET /api/prereqs` and surfaced as a banner in the Browse tab.
|
|
181
|
+
|
|
182
|
+
| Tool | Used for | Install hint |
|
|
183
|
+
| -------- | ------------------------------- | ----------------------------------------------------- |
|
|
184
|
+
| `npx` | npm-published MCP servers | ships with [Node.js](https://nodejs.org/) |
|
|
185
|
+
| `uvx` | PyPI-published MCP servers | install [uv](https://docs.astral.sh/uv/) |
|
|
186
|
+
| `docker` | Docker-image MCP servers (rare) | install [Docker](https://docs.docker.com/get-docker/) |
|
|
187
|
+
|
|
170
188
|
---
|
|
171
189
|
|
|
172
190
|
## Documentation
|
package/agent-desk-plugin.json
CHANGED
package/package.json
CHANGED