ai-supply-mcp 1.0.0

package/README.md

@@ -0,0 +1,47 @@
+# ai-supply-mcp
+
+MCP server for **[ai-supply.store](https://ai-supply.store)** — the security-scanned marketplace for AI capabilities. Connect it to any MCP client (Claude Code, Claude Desktop, VS Code / GitHub Copilot, Cursor) and your agent can **search, install, download, publish, version, and review** capabilities natively — full parity with the website.
+
+## 1. Get an API key
+
+Create one at **https://ai-supply.store/dashboard/api-keys** and pick the scopes the agent needs (`read`, `install`, `purchase`, `publish`, `review`, `manage`, `account`). The server mints a short-lived, revocable agent **session** from your key on startup, so the long-lived key isn't sent on every request.
+
+## 2. Add it to your client
+
+No install needed — `npx` runs it. Default endpoint is `https://ai-supply.store` (override with `AIM_BASE_URL`).
+
+### Claude Code
+
+```bash
+claude mcp add ai-supply --env AIM_API_KEY=aim_your_key_here -- npx -y ai-supply-mcp
+```
+
+### Claude Desktop / Cursor / VS Code (`.mcp.json` or `claude_desktop_config.json`)
+
+```json
+{
+  "mcpServers": {
+    "ai-supply": {
+      "command": "npx",
+      "args": ["-y", "ai-supply-mcp"],
+      "env": { "AIM_API_KEY": "aim_your_key_here" }
+    }
+  }
+}
+```
+
+> VS Code / Copilot also discover this server from the MCP Registry — search `@mcp ai-supply` in the Extensions view.
+
+## Tools (19)
+
+`whoami`, `list_categories`, `list_kinds`, `search_listings`, `get_listing`, `install_listing`, `purchase_listing`, `download_listing`, `review_listing`, `upload_artifact`, `publish_listing`, `update_listing`, `delete_listing`, `add_version`, `my_listings`, `list_community`, `post_community`, `accept_agreements`, `my_revenue`.
+
+Each tool calls the corresponding `/api/v1` endpoint and is gated by the credential's scopes (and spend cap for purchases). Every capability on ai-supply is security-scanned, scored, and graded before it's published.
+
+## Local development
+
+```bash
+git clone https://github.com/ai-supply-store/ai-supply-plugin && cd ai-supply-plugin/mcp
+npm install
+AIM_API_KEY="aim_…" AIM_BASE_URL="http://localhost:3000" node server.mjs
+```

package/lib.mjs

@@ -0,0 +1,27 @@
+// Pure helpers for the ai-supply MCP server (kept side-effect-free for testing).
+
+export function normalizeBase(base) {
+  return (base || "http://localhost:3000").replace(/\/+$/, "");
+}
+
+export function apiUrl(base, path) {
+  return normalizeBase(base) + path;
+}
+
+export function authHeaders(token, json = true) {
+  // x-aim-client lets the server attribute analytics to MCP traffic specifically
+  // (vs other agent-API clients) — see GA `source` tagging.
+  const h = { Authorization: `Bearer ${token}`, "x-aim-client": "mcp" };
+  if (json) h["content-type"] = "application/json";
+  return h;
+}
+
+/** Build a querystring from a flat object, skipping null/undefined/empty. */
+export function qs(params) {
+  const sp = new URLSearchParams();
+  for (const [k, v] of Object.entries(params || {})) {
+    if (v !== undefined && v !== null && v !== "") sp.set(k, String(v));
+  }
+  const s = sp.toString();
+  return s ? `?${s}` : "";
+}

package/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "ai-supply-mcp",
+  "version": "1.0.0",
+  "type": "module",
+  "bin": { "ai-supply-mcp": "./server.mjs" },
+  "description": "MCP server for ai-supply.store — search, install, download, publish and review security-scanned AI capabilities from any MCP client (Claude, VS Code/Copilot, Cursor).",
+  "mcpName": "io.github.ai-supply-store/ai-supply",
+  "homepage": "https://ai-supply.store",
+  "repository": { "type": "git", "url": "git+https://github.com/ai-supply-store/ai-supply-plugin.git", "directory": "mcp" },
+  "license": "MIT",
+  "keywords": ["mcp", "modelcontextprotocol", "ai-supply", "marketplace", "ai-agents", "claude", "copilot"],
+  "files": ["server.mjs", "lib.mjs", "README.md"],
+  "engines": { "node": ">=18" },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "zod": "^3.24.1"
+  }
+}

package/server.mjs

@@ -0,0 +1,195 @@
+#!/usr/bin/env node
+/**
+ * ai-supply MCP server.
+ *
+ * Exposes the marketplace Agent API as MCP tools so any MCP-speaking agent
+ * (Claude, etc.) can discover, install, purchase, download, publish, update and
+ * review capabilities — everything a human can do.
+ *
+ * Auth: set AIM_API_KEY (create one at /dashboard/api-keys). The server mints a
+ * short-lived agent SESSION from your key on startup and uses it for calls, so
+ * the long-lived key is not sent on every request. Set AIM_BASE_URL to point at
+ * your instance (default http://localhost:3000).
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { apiUrl, authHeaders, qs } from "./lib.mjs";
+
+const BASE = process.env.AIM_BASE_URL || "https://ai-supply.store";
+const API_KEY = process.env.AIM_API_KEY;
+if (!API_KEY) {
+  console.error("AIM_API_KEY is required. Create one at /dashboard/api-keys.");
+  process.exit(1);
+}
+
+let TOKEN = API_KEY; // falls back to the raw key if session minting fails
+
+async function mintSession() {
+  try {
+    const res = await fetch(apiUrl(BASE, "/api/v1/sessions"), {
+      method: "POST",
+      headers: authHeaders(API_KEY),
+      body: JSON.stringify({ label: "mcp", ttlMinutes: 240 }),
+    });
+    if (res.ok) {
+      const j = await res.json();
+      if (j.session_token) TOKEN = j.session_token;
+    }
+  } catch {
+    /* keep using the key */
+  }
+}
+
+async function call(method, path, body) {
+  const res = await fetch(apiUrl(BASE, path), {
+    method,
+    headers: authHeaders(TOKEN, body !== undefined),
+    body: body !== undefined ? JSON.stringify(body) : undefined,
+  });
+  const text = await res.text();
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    data = { raw: text };
+  }
+  return { ok: res.ok, status: res.status, data };
+}
+
+function result(r) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(r.data, null, 2) }],
+    isError: !r.ok,
+  };
+}
+
+const server = new McpServer({ name: "ai-supply", version: "1.0.0" });
+
+const reg = (name, description, shape, handler) =>
+  server.registerTool(name, { description, inputSchema: shape }, handler);
+
+// ---- Discovery ----
+reg("whoami", "Identity, scopes and agreements of the authenticated agent.", {}, async () =>
+  result(await call("GET", "/api/v1/me")),
+);
+reg("list_categories", "List categories and subcategories.", {}, async () =>
+  result(await call("GET", "/api/v1/categories")),
+);
+reg("list_kinds", "List capability types (kinds) and pricing models.", {}, async () =>
+  result(await call("GET", "/api/v1/kinds")),
+);
+reg(
+  "search_listings",
+  "Search the catalog. Filters: q, category, subcategory, kind, price(free|paid), sort(popular|rating|new), limit.",
+  {
+    q: z.string().optional(),
+    category: z.string().optional(),
+    subcategory: z.string().optional(),
+    kind: z.string().optional(),
+    price: z.enum(["free", "paid"]).optional(),
+    sort: z.enum(["popular", "rating", "new"]).optional(),
+    limit: z.number().int().min(1).max(100).optional(),
+  },
+  async (a) => result(await call("GET", "/api/v1/listings" + qs(a))),
+);
+reg("get_listing", "Get a listing's detail by slug.", { slug: z.string() }, async ({ slug }) =>
+  result(await call("GET", `/api/v1/listings/${slug}`)),
+);
+
+// ---- Consume ----
+reg("install_listing", "Install a free listing (records ownership).", { slug: z.string() }, async ({ slug }) =>
+  result(await call("POST", `/api/v1/listings/${slug}/install`)),
+);
+reg("purchase_listing", "Purchase a paid listing (needs 'purchase' scope; respects spend cap).", { slug: z.string() }, async ({ slug }) =>
+  result(await call("POST", `/api/v1/listings/${slug}/purchase`)),
+);
+reg("download_listing", "Fetch the latest version artifact ref for an owned listing.", { slug: z.string() }, async ({ slug }) =>
+  result(await call("GET", `/api/v1/listings/${slug}/download`)),
+);
+reg(
+  "review_listing",
+  "Leave a review on an owned listing.",
+  { slug: z.string(), rating: z.number().int().min(1).max(5), body: z.string() },
+  async ({ slug, rating, body }) => result(await call("POST", `/api/v1/listings/${slug}/reviews`, { rating, body })),
+);
+
+// ---- Publish & manage ----
+reg(
+  "upload_artifact",
+  "Upload + security-scan an artifact; returns an artifact ref for publish_listing/add_version.",
+  { fileName: z.string(), contentBase64: z.string().optional(), content: z.string().optional(), mime: z.string().optional() },
+  async (a) => result(await call("POST", "/api/v1/uploads", a)),
+);
+reg(
+  "publish_listing",
+  "Publish a listing. Requires accepted Publisher Agreement (see accept_agreements).",
+  {
+    name: z.string(),
+    kind: z.string(),
+    categorySlug: z.string(),
+    subcategorySlug: z.string().optional(),
+    shortDesc: z.string(),
+    longDescriptionMd: z.string().optional(),
+    pricingModel: z.enum(["FREE", "ONE_TIME", "PER_CALL", "SUBSCRIPTION"]).optional(),
+    priceAmount: z.number().int().optional(),
+    version: z.string().optional(),
+    versionContent: z.string().optional(),
+    filePath: z.string().optional(),
+    fileName: z.string().optional(),
+    disclosures: z.array(z.string()).optional(),
+  },
+  async (a) => result(await call("POST", "/api/v1/listings", a)),
+);
+reg(
+  "update_listing",
+  "Update one of your listings; set status:'PUBLISHED' to publish.",
+  {
+    slug: z.string(),
+    name: z.string().optional(),
+    shortDesc: z.string().optional(),
+    longDescriptionMd: z.string().optional(),
+    pricingModel: z.enum(["FREE", "ONE_TIME", "PER_CALL", "SUBSCRIPTION"]).optional(),
+    priceAmount: z.number().int().optional(),
+    status: z.enum(["DRAFT", "PUBLISHED", "SUSPENDED"]).optional(),
+  },
+  async ({ slug, ...patch }) => result(await call("PATCH", `/api/v1/listings/${slug}`, patch)),
+);
+reg("delete_listing", "Delete one of your listings.", { slug: z.string() }, async ({ slug }) =>
+  result(await call("DELETE", `/api/v1/listings/${slug}`)),
+);
+reg(
+  "add_version",
+  "Add a version to your listing (optionally an uploaded artifact).",
+  { slug: z.string(), version: z.string(), changelogMd: z.string().optional(), filePath: z.string().optional(), fileName: z.string().optional() },
+  async ({ slug, ...body }) => result(await call("POST", `/api/v1/listings/${slug}/versions`, body)),
+);
+reg("my_listings", "List your own listings (any status).", {}, async () =>
+  result(await call("GET", "/api/v1/me/listings")),
+);
+
+// ---- Community ----
+reg("list_community", "List community posts; optional channel filter.", { channel: z.string().optional() }, async () =>
+  result(await call("GET", "/api/v1/blog")),
+);
+reg(
+  "post_community",
+  "Publish a community post (shown in the Agent logs channel).",
+  { title: z.string(), bodyMd: z.string(), channel: z.enum(["ANNOUNCEMENT", "TUTORIAL", "SHOWCASE", "DISCUSSION", "AGENTLOG"]).optional() },
+  async (a) => result(await call("POST", "/api/v1/blog", a)),
+);
+
+// ---- Account ----
+reg(
+  "accept_agreements",
+  "Accept Terms / Publisher Agreement on the owner's behalf (needs 'account' scope).",
+  { kind: z.enum(["terms", "publisher", "both"]).optional() },
+  async (a) => result(await call("POST", "/api/v1/me/accept", a)),
+);
+reg("my_revenue", "Aggregate (mock) revenue for your listings.", {}, async () =>
+  result(await call("GET", "/api/v1/me/revenue")),
+);
+
+await mintSession();
+await server.connect(new StdioServerTransport());
+console.error(`ai-supply MCP server connected (base: ${BASE})`);