ai-supply-mcp 1.0.0 → 1.1.0

package/README.md

@@ -1,10 +1,10 @@
 # ai-supply-mcp
 
-MCP server for **[ai-supply.store](https://ai-supply.store)** — the security-scanned marketplace for AI capabilities. Connect it to any MCP client (Claude Code, Claude Desktop, VS Code / GitHub Copilot, Cursor) and your agent can **search, install, download, publish, version, and review** capabilities natively — full parity with the website.
+MCP server for **[ai-supply.store](https://ai-supply.store)** — the free, security-vetted registry of AI capabilities. Every capability is downloaded, scanned, and graded **0–100 (A–D)** for security before it's listed; risky ones are hidden by default. Connect it to any MCP client (Claude Code, Claude Desktop, VS Code / GitHub Copilot, Cursor) and your agent can **search, install, download, publish, version, and review** capabilities natively — full parity with the website, and every search result carries its security score.
 
 ## 1. Get an API key
 
-Create one at **https://ai-supply.store/dashboard/api-keys** and pick the scopes the agent needs (`read`, `install`, `purchase`, `publish`, `review`, `manage`, `account`). The server mints a short-lived, revocable agent **session** from your key on startup, so the long-lived key isn't sent on every request.
+Create one at **https://ai-supply.store/dashboard/api-keys** and pick the scopes the agent needs (`read`, `install`, `publish`, `review`, `manage`, `account`). The `read` scope alone is enough to browse the vetted catalog. The server mints a short-lived, revocable agent **session** from your key on startup, so the long-lived key isn't sent on every request.
 
 ## 2. Add it to your client
 
@@ -32,11 +32,11 @@ claude mcp add ai-supply --env AIM_API_KEY=aim_your_key_here -- npx -y ai-supply
 
 > VS Code / Copilot also discover this server from the MCP Registry — search `@mcp ai-supply` in the Extensions view.
 
-## Tools (19)
+## Tools (17)
 
-`whoami`, `list_categories`, `list_kinds`, `search_listings`, `get_listing`, `install_listing`, `purchase_listing`, `download_listing`, `review_listing`, `upload_artifact`, `publish_listing`, `update_listing`, `delete_listing`, `add_version`, `my_listings`, `list_community`, `post_community`, `accept_agreements`, `my_revenue`.
+`whoami`, `list_categories`, `list_kinds`, `search_listings`, `get_listing`, `install_listing`, `download_listing`, `review_listing`, `upload_artifact`, `publish_listing`, `update_listing`, `delete_listing`, `add_version`, `my_listings`, `list_community`, `post_community`, `accept_agreements`.
 
-Each tool calls the corresponding `/api/v1` endpoint and is gated by the credential's scopes (and spend cap for purchases). Every capability on ai-supply is security-scanned, scored, and graded before it's published.
+Each tool calls the corresponding `/api/v1` endpoint and is gated by the credential's scopes. Every capability on ai-supply is security-scanned and graded (0–100 score, A–D grade) before it's listed — `search_listings` supports `sort: "security"` to rank the most-secure first, `get_listing` returns the full scan findings, and quarantined (critical-finding) listings are hidden by default. The whole catalog is **free**. See <https://ai-supply.store/security> for the vetting methodology.
 
 ## Local development
 

package/package.json

@@ -1,16 +1,36 @@
 {
   "name": "ai-supply-mcp",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "type": "module",
-  "bin": { "ai-supply-mcp": "./server.mjs" },
+  "bin": {
+    "ai-supply-mcp": "./server.mjs"
+  },
   "description": "MCP server for ai-supply.store — search, install, download, publish and review security-scanned AI capabilities from any MCP client (Claude, VS Code/Copilot, Cursor).",
   "mcpName": "io.github.ai-supply-store/ai-supply",
   "homepage": "https://ai-supply.store",
-  "repository": { "type": "git", "url": "git+https://github.com/ai-supply-store/ai-supply-plugin.git", "directory": "mcp" },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ai-supply-store/ai-supply-plugin.git",
+    "directory": "mcp"
+  },
   "license": "MIT",
-  "keywords": ["mcp", "modelcontextprotocol", "ai-supply", "marketplace", "ai-agents", "claude", "copilot"],
-  "files": ["server.mjs", "lib.mjs", "README.md"],
-  "engines": { "node": ">=18" },
+  "keywords": [
+    "mcp",
+    "modelcontextprotocol",
+    "ai-supply",
+    "marketplace",
+    "ai-agents",
+    "claude",
+    "copilot"
+  ],
+  "files": [
+    "server.mjs",
+    "lib.mjs",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^3.24.1"

package/server.mjs

@@ -2,9 +2,11 @@
 /**
  * ai-supply MCP server.
  *
- * Exposes the marketplace Agent API as MCP tools so any MCP-speaking agent
- * (Claude, etc.) can discover, install, purchase, download, publish, update and
- * review capabilities — everything a human can do.
+ * Exposes the ai-supply Agent API as MCP tools so any MCP-speaking agent
+ * (Claude, etc.) can discover, install, download, publish, update and review
+ * capabilities from a free, security-vetted registry — everything a human can do.
+ * Every listing is security-scanned and graded (0–100 score, A–D grade); risky
+ * (quarantined) ones are hidden by default and each result carries its score.
  *
  * Auth: set AIM_API_KEY (create one at /dashboard/api-keys). The server mints a
  * short-lived agent SESSION from your key on startup and uses it for calls, so
@@ -18,10 +20,10 @@ import { apiUrl, authHeaders, qs } from "./lib.mjs";
 
 const BASE = process.env.AIM_BASE_URL || "https://ai-supply.store";
 const API_KEY = process.env.AIM_API_KEY;
-if (!API_KEY) {
-  console.error("AIM_API_KEY is required. Create one at /dashboard/api-keys.");
-  process.exit(1);
-}
+// Don't exit when the key is missing — start anyway so the client lists the tools,
+// and return a clear setup hint from each call (silent exit = confusing "0 tools").
+const NO_KEY_MSG =
+  "No API key configured. Set the AIM_API_KEY environment variable for the ai-supply MCP server and reload — create one (the 'read' scope is enough to browse) at https://ai-supply.store/dashboard/api-keys";
 
 let TOKEN = API_KEY; // falls back to the raw key if session minting fails
 
@@ -42,6 +44,7 @@ async function mintSession() {
 }
 
 async function call(method, path, body) {
+  if (!API_KEY) return { ok: false, status: 401, data: { error: NO_KEY_MSG } };
   const res = await fetch(apiUrl(BASE, path), {
     method,
     headers: authHeaders(TOKEN, body !== undefined),
@@ -54,6 +57,13 @@ async function call(method, path, body) {
   } catch {
     data = { raw: text };
   }
+  if (res.status === 401) {
+    data = {
+      error:
+        "ai-supply rejected the API key (401). Check AIM_API_KEY or create a fresh one at https://ai-supply.store/dashboard/api-keys",
+      detail: data,
+    };
+  }
   return { ok: res.ok, status: res.status, data };
 }
 
@@ -64,7 +74,7 @@ function result(r) {
   };
 }
 
-const server = new McpServer({ name: "ai-supply", version: "1.0.0" });
+const server = new McpServer({ name: "ai-supply", version: "1.1.0" });
 
 const reg = (name, description, shape, handler) =>
   server.registerTool(name, { description, inputSchema: shape }, handler);
@@ -76,34 +86,30 @@ reg("whoami", "Identity, scopes and agreements of the authenticated agent.", {},
 reg("list_categories", "List categories and subcategories.", {}, async () =>
   result(await call("GET", "/api/v1/categories")),
 );
-reg("list_kinds", "List capability types (kinds) and pricing models.", {}, async () =>
+reg("list_kinds", "List capability types (kinds).", {}, async () =>
   result(await call("GET", "/api/v1/kinds")),
 );
 reg(
   "search_listings",
-  "Search the catalog. Filters: q, category, subcategory, kind, price(free|paid), sort(popular|rating|new), limit.",
+  "Search the security-vetted catalog. Filters: q, category, subcategory, kind, sort(popular|rating|new|security), limit. Every result carries a security score (0–100) + grade (A–D); risky (quarantined) listings are hidden by default. All listings are free.",
   {
     q: z.string().optional(),
     category: z.string().optional(),
     subcategory: z.string().optional(),
     kind: z.string().optional(),
-    price: z.enum(["free", "paid"]).optional(),
-    sort: z.enum(["popular", "rating", "new"]).optional(),
+    sort: z.enum(["popular", "rating", "new", "security"]).optional(),
     limit: z.number().int().min(1).max(100).optional(),
   },
   async (a) => result(await call("GET", "/api/v1/listings" + qs(a))),
 );
-reg("get_listing", "Get a listing's detail by slug.", { slug: z.string() }, async ({ slug }) =>
+reg("get_listing", "Get a listing's full detail by slug — including its security score, grade, level and scan findings.", { slug: z.string() }, async ({ slug }) =>
   result(await call("GET", `/api/v1/listings/${slug}`)),
 );
 
 // ---- Consume ----
-reg("install_listing", "Install a free listing (records ownership).", { slug: z.string() }, async ({ slug }) =>
+reg("install_listing", "Install a listing (free; records ownership). Downloads are gated on a passing security scan.", { slug: z.string() }, async ({ slug }) =>
   result(await call("POST", `/api/v1/listings/${slug}/install`)),
 );
-reg("purchase_listing", "Purchase a paid listing (needs 'purchase' scope; respects spend cap).", { slug: z.string() }, async ({ slug }) =>
-  result(await call("POST", `/api/v1/listings/${slug}/purchase`)),
-);
 reg("download_listing", "Fetch the latest version artifact ref for an owned listing.", { slug: z.string() }, async ({ slug }) =>
   result(await call("GET", `/api/v1/listings/${slug}/download`)),
 );
@@ -131,8 +137,6 @@ reg(
     subcategorySlug: z.string().optional(),
     shortDesc: z.string(),
     longDescriptionMd: z.string().optional(),
-    pricingModel: z.enum(["FREE", "ONE_TIME", "PER_CALL", "SUBSCRIPTION"]).optional(),
-    priceAmount: z.number().int().optional(),
     version: z.string().optional(),
     versionContent: z.string().optional(),
     filePath: z.string().optional(),
@@ -149,8 +153,6 @@ reg(
     name: z.string().optional(),
     shortDesc: z.string().optional(),
     longDescriptionMd: z.string().optional(),
-    pricingModel: z.enum(["FREE", "ONE_TIME", "PER_CALL", "SUBSCRIPTION"]).optional(),
-    priceAmount: z.number().int().optional(),
     status: z.enum(["DRAFT", "PUBLISHED", "SUSPENDED"]).optional(),
   },
   async ({ slug, ...patch }) => result(await call("PATCH", `/api/v1/listings/${slug}`, patch)),
@@ -186,10 +188,10 @@ reg(
   { kind: z.enum(["terms", "publisher", "both"]).optional() },
   async (a) => result(await call("POST", "/api/v1/me/accept", a)),
 );
-reg("my_revenue", "Aggregate (mock) revenue for your listings.", {}, async () =>
-  result(await call("GET", "/api/v1/me/revenue")),
-);
 
-await mintSession();
+if (API_KEY) await mintSession();
 await server.connect(new StdioServerTransport());
-console.error(`ai-supply MCP server connected (base: ${BASE})`);
+console.error(
+  `ai-supply MCP server connected (base: ${BASE})` +
+    (API_KEY ? "" : " — WARNING: AIM_API_KEY not set; tools will return a setup hint until you configure it."),
+);