artifacty 0.3.0 → 0.5.0

package/README.md

@@ -175,6 +175,10 @@ artifacty-mcp
 ```
 
 MCP clients can create artifacts with `artifacty_create`. `artifacty_publish` remains as a backwards-compatible alias.
+MCP clients that support resources or prompts can also read `artifacty://recent`,
+`artifacty://artifacts/{id}`, `artifacty://artifacts/{id}/raw{?version}`, and
+`artifacty://schema/v1`, or use prompt templates such as `artifacty_handoff`,
+`artifacty_review`, and `artifacty_release_notes`.
 
 Operational commands:
 
@@ -275,14 +279,17 @@ Schema and storage:
 - Diagram, component, source snippet, analysis report, table, and media assets use `diagram`, `component`, `snippet`, `analysis-report`, `table`, and `asset` artifact types.
 - Copilot/Cursor examples cover PR reviews, screenshots, demo recordings, and visual evidence bundles.
 - See [docs/artifact-schema-v1.md](docs/artifact-schema-v1.md).
+- See [docs/mcp-public-api.md](docs/mcp-public-api.md) for MCP tools, resources, prompts, and compatibility notes.
 - See [docs/sarif-csv-artifact-plan.md](docs/sarif-csv-artifact-plan.md) for the SARIF/CSV output artifact roadmap.
 
 ## Security Model
 
 - The HTTP server binds to `127.0.0.1` by default.
-- If `ARTIFACTY_API_TOKEN` is set, HTTP API routes require `Authorization: Bearer <token>` or `x-artifacty-token`.
+- If `ARTIFACTY_API_TOKEN` is set, HTTP API routes require `Authorization: Bearer <token>` or `x-artifacty-token`; scripts should prefer headers over `?token=...` URLs.
+- API token checks use timing-safe digest comparison.
 - Binding outside localhost requires both `ARTIFACTY_SHARE_MODE=lan` or `team` and `ARTIFACTY_API_TOKEN`.
 - Non-local sharing is intended for trusted LAN or VPN sessions. Prefer a specific interface IP over `0.0.0.0`, keep React rendering disabled, and see [docs/network-sharing.md](docs/network-sharing.md).
+- Non-local binding prints a startup warning because Artifacty does not terminate TLS.
 - Artifact content is scanned for common API keys and private keys before storage. Use `--allow-secrets` or `ARTIFACTY_ALLOW_SECRETS=true` only for intentional exceptions.
 - Creates, updates, reads, imports, archives, and restores write audit events to SQLite.
 - CodeMirror editor/viewer and renderer assets are served from local npm dependencies through a package allowlist, not from a public CDN. JavaScript asset routes answer `Origin: null` requests with `Access-Control-Allow-Origin: null` so sandboxed renderer iframes can import local ESM without `allow-same-origin`.
@@ -295,5 +302,6 @@ Schema and storage:
 - CSV artifacts render as an escaped, bounded table; `/raw` preserves the original text.
 - Image and video artifacts store base64 media inline, render safe previews, and decode bytes through `/raw`.
 - Artifact content should still be treated as untrusted; use the raw view when handing content back to an agent.
+- npm releases are published with GitHub Actions OIDC Trusted Publishing after lint, test, and smoke checks pass.
 
-See [docs/release-checklist.md](docs/release-checklist.md) before publishing or running a shared instance.
+See [SECURITY.md](SECURITY.md), [docs/threat-model.md](docs/threat-model.md), and [docs/release-checklist.md](docs/release-checklist.md) before publishing or running a shared instance.

package/SECURITY.md

@@ -0,0 +1,49 @@
+# Security Policy
+
+## Supported Versions
+
+Artifacty is pre-1.0. Security fixes are provided for the latest published
+minor release. Upgrade to the latest `artifacty` version before reporting a
+suspected issue.
+
+## Reporting a Vulnerability
+
+Use GitHub private vulnerability reporting if it is enabled for this repository.
+If private reporting is unavailable, open a GitHub issue with a minimal summary
+and avoid including exploit details, secrets, private artifacts, or sensitive
+network information.
+
+Please include:
+
+- Artifacty version and install method.
+- Node.js version and operating system.
+- Whether the HTTP server was localhost-only, LAN/team mode, or behind a proxy.
+- Whether `ARTIFACTY_API_TOKEN` and `ARTIFACTY_ENABLE_REACT_RENDERER` were set.
+- Reproduction steps using non-sensitive sample content.
+
+## Security Model
+
+Artifacty is local-first. The default HTTP server binds to `127.0.0.1`; binding
+outside loopback requires `ARTIFACTY_SHARE_MODE=lan|team` and an API token.
+
+The project treats artifact content as untrusted:
+
+- HTML, SVG, Mermaid, and React rendering use sandboxed frames and scoped CSP.
+- React execution is disabled unless `ARTIFACTY_ENABLE_REACT_RENDERER=true`.
+- Mutating browser routes reject non-local `Origin` headers.
+- API token checks use constant-time digest comparison.
+- Artifact content is scanned for common API keys and private keys before
+  storage unless explicitly allowed.
+
+Artifacty does not provide TLS termination, remote OAuth, multi-user access
+control, or a hosted sync service. Do not expose the server directly to the
+public internet.
+
+## Supply Chain
+
+npm releases are published through GitHub Actions using npm Trusted Publishing
+OIDC. The release workflow runs lint, tests, and smoke checks on supported Node
+versions before publishing.
+
+See [docs/threat-model.md](docs/threat-model.md) and
+[docs/network-sharing.md](docs/network-sharing.md) for operational guidance.

package/docs/integrations.md

@@ -83,7 +83,21 @@ node src/cli.js check
 - Cursor: writes project `.cursor/mcp.json` using the Cursor `mcpServers` shape. Pass `--config ~/.cursor/mcp.json` for global Cursor setup.
 - `--dry-run` returns the generated config without writing it.
 - `--timeout <ms>` adjusts Codex `startup_timeout_sec` and Gemini `timeout`. It does not change Claude Code startup behavior; set `MCP_TIMEOUT` before launching Claude Code if you need a larger value there.
-- `check` starts the local MCP server and verifies required tools through `initialize` and `tools/list`.
+- `check` starts the local MCP server and verifies required tools, resources, and prompts through MCP discovery methods.
+
+## Client Compatibility Matrix
+
+| Client | Config shape | Scope | Timeout behavior | Restart requirement | Notes |
+| --- | --- | --- | --- | --- | --- |
+| Claude Code | `.mcp.json` `mcpServers` | project | parent `MCP_TIMEOUT`, default 30s | restart Claude Code | no per-server startup timeout field |
+| Codex | TOML `[mcp_servers.artifacty]` | user or explicit config | `startup_timeout_sec = 30.0` | restart Codex session | Windows cold starts may need the 30s default |
+| Gemini CLI | JSON `mcpServers` | user or project | `timeout: 30000` | reload `/mcp` or restart | `trust` is preserved from installer options |
+| GitHub Copilot in VS Code | `.vscode/mcp.json` `servers` | workspace or user profile | client-managed | reload VS Code MCP server | tools are the primary tested surface |
+| Cursor | `.cursor/mcp.json` `mcpServers` | workspace or global | client-managed | restart/reload Cursor MCP | tools are the primary tested surface |
+
+All clients should support MCP tools. Resource and prompt display varies by
+client, so Artifacty's core workflows continue to work through tools even when a
+client does not expose resources or prompts in its UI.
 
 Generate a token for protected HTTP routes:
 
@@ -196,6 +210,25 @@ Then run `/mcp` inside Gemini CLI to confirm that the Artifacty tools are connec
 
 Mutating MCP tools scan content for common API keys and private keys before storage. Pass `allowSecrets: true` only for intentional exceptions.
 
+## MCP Resources and Prompts
+
+Artifacty also exposes read-only MCP resources:
+
+- `artifacty://recent`: recent artifacts with pagination and browser URLs.
+- `artifacty://schema/v1`: Artifact schema v1 Markdown.
+- `artifacty://artifacts/{id}`: artifact JSON with metadata, content, and URLs.
+- `artifacty://artifacts/{id}/raw{?version}`: raw latest or versioned content.
+
+Prompt templates:
+
+- `artifacty_handoff`: continuation handoff.
+- `artifacty_review`: findings-first code review artifact.
+- `artifacty_test_report`: verification evidence.
+- `artifacty_visual_qa`: screenshot/media/browser evidence.
+- `artifacty_release_notes`: release notes with publish evidence and risks.
+
+See [mcp-public-api.md](mcp-public-api.md) for the public MCP surface.
+
 ## Importing Agent Artifacts
 
 Use `artifacty_import` or the CLI `import` command when the artifact was produced by another agent and needs normalization before sharing.

package/docs/mcp-public-api.md

@@ -0,0 +1,68 @@
+# MCP Public API
+
+Artifacty's MCP stdio server is the primary agent-to-agent integration surface.
+The server currently targets MCP protocol `2025-06-18`.
+
+## Capabilities
+
+`initialize` advertises:
+
+- `tools`: Artifact create, import, list, get, update, archive, restore, audit, and info.
+- `resources`: static and dynamic read-only artifact resources.
+- `prompts`: reusable workflow prompt templates.
+
+## Tools
+
+Stable tool names:
+
+- `artifacty_create`: create a native Artifacty artifact.
+- `artifacty_publish`: backwards-compatible alias for `artifacty_create`.
+- `artifacty_import`: convert external Claude, Codex, Gemini, Copilot, Cursor, Artifacty, or generic payloads.
+- `artifacty_list`: list artifacts with `query`, `tag`, `sourceAgent`, `includeArchived`, `limit`, and `offset`.
+- `artifacty_get`: read one artifact by `id` and optional `version`.
+- `artifacty_update`: append an immutable version.
+- `artifacty_archive` / `artifacty_restore`: toggle archive state.
+- `artifacty_audit`: list audit events.
+- `artifacty_info`: return local store and browser URL information.
+
+Tool schemas use Artifacty schema v1 formats and artifact types. New optional
+properties may be added during 0.x releases; existing names should not be
+renamed without a documented migration.
+
+## Resources
+
+Static resources:
+
+- `artifacty://recent`: JSON list of recent artifacts with pagination and browser URLs.
+- `artifacty://schema/v1`: Markdown reference for Artifacty schema v1.
+
+Resource templates:
+
+- `artifacty://artifacts/{id}`: JSON artifact metadata, selected version, content, and URLs.
+- `artifacty://artifacts/{id}/raw{?version}`: raw artifact content for latest or specified version.
+
+Resources are read-only and may record an audit `read` event for artifact content.
+
+## Prompts
+
+Prompt names:
+
+- `artifacty_handoff`
+- `artifacty_review`
+- `artifacty_test_report`
+- `artifacty_visual_qa`
+- `artifacty_release_notes`
+
+Each prompt returns one user message that instructs an agent to create or update
+an Artifacty artifact with discoverable `artifactType`, `sourceAgent`, and tags.
+Prompts accept optional context arguments such as `artifactId`, `goal`, `scope`,
+`target`, or `version`.
+
+## Compatibility Notes
+
+- The MCP server is local stdio only. Remote MCP auth/OAuth is out of scope.
+- Binary media resources return stored base64 text through MCP; browser `/raw`
+  decodes first-class `image` and `video` artifacts into bytes.
+- Clients may display resources and prompts differently. Tools remain the most
+  widely supported integration path across Claude, Codex, Gemini, Copilot, and
+  Cursor.

package/docs/network-sharing.md

@@ -30,6 +30,8 @@ The generated token protects HTTP API routes and browser write forms. Prefer the
 
 Artifacty does not terminate TLS. Do not expose it directly on the public internet. If a shared instance must cross an untrusted network, put it behind a TLS reverse proxy or a private VPN.
 
+When Artifacty binds outside loopback, startup output includes a warning that the server is reachable beyond the local machine and that TLS is not provided by Artifacty.
+
 ## Browser Write Behavior
 
 Remote browsers can read shared pages, but write actions are intentionally conservative. Mutating browser routes reject non-local `Origin` headers to reduce CSRF risk. For LAN sharing, prefer API or MCP writes with an explicit token header.
@@ -39,3 +41,5 @@ Do not relax the origin check just to make remote browser writes easier. A futur
 ## Renderer Guidance
 
 Artifact content is untrusted. HTML, SVG, Mermaid, and React artifacts are rendered with sandboxing and CSP controls, but shared viewing still means content reaches another user's browser. Keep `ARTIFACTY_ENABLE_REACT_RENDERER` disabled for LAN sessions unless every viewer trusts the artifact source.
+
+See [threat-model.md](threat-model.md) for the full trust-boundary summary.

package/docs/release-checklist.md

@@ -8,7 +8,7 @@ Use this checklist before publishing or distributing Artifacty.
 npm run release:check
 ```
 
-This runs syntax checks, the full Node test suite, and a local smoke test that starts the HTTP server with token auth enabled, creates an artifact, verifies secret blocking, reads audit logs, writes a backup, and checks MCP tool discovery.
+This runs syntax checks, the full Node test suite, and a local smoke test that starts the HTTP server with token auth enabled, creates an artifact, verifies secret blocking, reads audit logs, writes a backup, and checks MCP tool/resource/prompt discovery.
 
 ## Packaging
 
@@ -23,7 +23,10 @@ This runs syntax checks, the full Node test suite, and a local smoke test that s
 
 - Keep the default HTTP bind address at `127.0.0.1`.
 - Require `ARTIFACTY_API_TOKEN` and `ARTIFACTY_SHARE_MODE=lan` or `team` before binding to `0.0.0.0`.
+- Confirm non-loopback startup output includes the LAN/team warning.
+- Prefer `x-artifacty-token` or `Authorization: Bearer <token>` over query tokens in scripts.
 - Review secret-scan bypasses. `--allow-secrets` and `ARTIFACTY_ALLOW_SECRETS=true` should be deliberate and temporary.
+- Review [../SECURITY.md](../SECURITY.md) and [threat-model.md](threat-model.md) when changing auth, rendering, MCP, or network-sharing behavior.
 - Treat artifact HTML and imported agent payloads as untrusted content.
 - Confirm scripted artifact iframes never include `allow-same-origin`.
 - Confirm `/assets/*` and `/vendor/npm/*` JavaScript responses return
@@ -35,6 +38,8 @@ This runs syntax checks, the full Node test suite, and a local smoke test that s
   not prove Mermaid or React rendered inside the iframe.
 - Keep `ARTIFACTY_ENABLE_REACT_RENDERER` disabled by default. Enable it only when the operator accepts arbitrary component execution risk.
 - Confirm parent app CSP does not include `unsafe-eval`; it should appear only on the React frame response CSP.
+- Confirm CodeQL, Scorecard, and Dependabot configuration changes are intentional.
+- Confirm npm publish still uses OIDC Trusted Publishing rather than a long-lived npm token.
 
 ## Operations
 

package/docs/threat-model.md

@@ -0,0 +1,128 @@
+# Threat Model
+
+Artifacty is a local artifact exchange for LLM agents. It is designed for one
+operator, one local store, and trusted local MCP clients by default.
+
+## Assets
+
+- Artifact content, including generated code, reports, screenshots, and media.
+- Artifact metadata, tags, audit records, and version history.
+- API tokens and generated startup tokens.
+- Local MCP client configuration files.
+- The Artifacty SQLite database and immutable version files.
+
+## Trust Boundaries
+
+- **HTTP browser server**: local by default, optionally reachable on LAN/team
+  networks when explicitly configured.
+- **MCP stdio server**: local process launched by an MCP client. It inherits the
+  local user account's filesystem permissions.
+- **Artifact renderers**: untrusted content is rendered inside browser sandbox
+  boundaries where practical.
+- **Storage**: Artifacty stores content under `ARTIFACTY_HOME`; anyone with
+  filesystem access to that directory can read artifacts.
+- **npm package**: published through GitHub Actions OIDC after automated checks.
+
+## Primary Threats and Controls
+
+### Accidental Network Exposure
+
+Risk: binding to `0.0.0.0` exposes Artifacty on every interface, including VPNs
+or cloud VM public interfaces.
+
+Controls:
+
+- Default host is `127.0.0.1`.
+- Non-loopback binding requires `ARTIFACTY_SHARE_MODE=lan|team`.
+- Non-loopback binding also requires `ARTIFACTY_API_TOKEN`.
+- Startup logs warn when the server binds outside loopback.
+
+Guidance: prefer a specific private interface IP over `0.0.0.0`. Do not expose
+Artifacty directly to the public internet.
+
+### Token Leakage
+
+Risk: query-string tokens can appear in browser history, shell history, logs, or
+referrers.
+
+Controls:
+
+- Scripts should use `x-artifacty-token` or `Authorization: Bearer <token>`.
+- Browser form token URLs exist only for local convenience.
+- Token comparisons use timing-safe digest comparison.
+
+Guidance: rotate tokens after sharing sessions and prefer foreground generated
+tokens for temporary LAN use.
+
+### Cross-Site Request Forgery
+
+Risk: a remote website could attempt to submit writes to an Artifacty server
+reachable from the user's browser.
+
+Controls:
+
+- Mutating browser routes reject non-local `Origin` headers.
+- API routes require a token when configured.
+- LAN/team mode does not relax browser-origin checks.
+
+### Untrusted Artifact Rendering
+
+Risk: HTML, SVG, Mermaid, or React content could execute code in a viewer's
+browser.
+
+Controls:
+
+- HTML artifacts render in sandboxed iframes.
+- SVG artifacts render in scriptless sandboxed iframes after viewer-side
+  sanitization.
+- Mermaid renders in a sandboxed iframe without `allow-same-origin`.
+- React is source-only unless `ARTIFACTY_ENABLE_REACT_RENDERER=true`.
+- React rendering, when enabled, runs in a separate sandboxed frame with
+  frame-scoped CSP.
+
+Guidance: keep React rendering disabled for shared sessions unless all viewers
+trust the source.
+
+### Secret Storage
+
+Risk: agents may accidentally publish API keys or private keys into artifacts.
+
+Controls:
+
+- Common API key and private key patterns are scanned before storage.
+- Writes fail unless `allowSecrets` or `ARTIFACTY_ALLOW_SECRETS=true` is set.
+- Stored scan status is recorded in version metadata.
+
+Limitations: pattern scanning is best-effort and does not prove content is free
+of sensitive data.
+
+### MCP Tool Abuse
+
+Risk: an MCP client can create, update, import, archive, restore, and read local
+artifacts through stdio.
+
+Controls:
+
+- MCP is local stdio only.
+- MCP writes go through the same secret scan and audit paths as CLI/HTTP writes.
+- MCP resources are read-only.
+
+Guidance: install Artifacty MCP only in clients and workspaces you trust.
+
+## Out of Scope
+
+- Public internet hosting without a separate TLS/auth proxy.
+- Multi-user browser write access.
+- OAuth or remote MCP authorization.
+- Per-artifact ACLs.
+- Encrypted-at-rest storage.
+- Malware analysis of arbitrary artifact content.
+
+## Security Review Checklist
+
+- Run `npm run release:check`.
+- Run `artifacty integrity` against important stores.
+- Confirm non-local sharing uses a token and trusted LAN/VPN.
+- Keep `ARTIFACTY_ENABLE_REACT_RENDERER` disabled unless required.
+- Prefer token headers over query tokens in scripts.
+- Review generated MCP configs before committing workspace files.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "artifacty",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Local artifact exchange for heterogeneous LLM agents via HTTP and MCP.",
   "type": "module",
   "keywords": [
@@ -37,12 +37,15 @@
     "docs/artifact-schema-v1.md",
     "docs/assets/artifacty.png",
     "docs/integrations.md",
+    "docs/mcp-public-api.md",
     "docs/network-sharing.md",
     "docs/release-checklist.md",
     "docs/sarif-csv-artifact-plan.md",
+    "docs/threat-model.md",
     "scripts/smoke.sh",
     "README.md",
     "LICENSE",
+    "SECURITY.md",
     "THIRD_PARTY_NOTICES.md",
     "AGENTS.md",
     "CLAUDE.md"

package/src/cli.js

@@ -68,6 +68,9 @@ async function main() {
     });
     process.stderr.write(`Artifacty listening on ${server.url}\n`);
     process.stderr.write(`Store: ${server.store.home}\n`);
+    if (server.securityWarning) {
+      process.stderr.write(`${server.securityWarning}\n`);
+    }
     if (generatedToken) {
       process.stderr.write(`API token: ${generatedToken.token}\n`);
       process.stderr.write(`HTTP header: ${generatedToken.header}\n`);

package/src/lib/check.js

@@ -14,10 +14,25 @@ export const REQUIRED_MCP_TOOLS = [
   "artifacty_info"
 ];
 
+export const REQUIRED_MCP_RESOURCES = [
+  "artifacty://recent",
+  "artifacty://schema/v1"
+];
+
+export const REQUIRED_MCP_PROMPTS = [
+  "artifacty_handoff",
+  "artifacty_review",
+  "artifacty_test_report",
+  "artifacty_visual_qa",
+  "artifacty_release_notes"
+];
+
 export async function checkMcpTools(options = {}) {
   const projectDir = path.resolve(options.projectDir || process.cwd());
   const serverPath = path.resolve(options.serverPath || path.join(projectDir, "src", "mcp-server.js"));
   const requiredTools = options.requiredTools || REQUIRED_MCP_TOOLS;
+  const requiredResources = options.requiredResources || REQUIRED_MCP_RESOURCES;
+  const requiredPrompts = options.requiredPrompts || REQUIRED_MCP_PROMPTS;
   const timeoutMs = Number(options.timeout || 5000);
   const client = spawnMcpClient({
     serverPath,
@@ -39,14 +54,26 @@ export async function checkMcpTools(options = {}) {
     const listed = await client.request("tools/list", {});
     const toolNames = (listed.tools || []).map((tool) => tool.name).sort();
     const missingTools = requiredTools.filter((tool) => !toolNames.includes(tool));
+    const listedResources = await client.request("resources/list", {});
+    const resourceUris = (listedResources.resources || []).map((resource) => resource.uri).sort();
+    const missingResources = requiredResources.filter((resource) => !resourceUris.includes(resource));
+    const listedPrompts = await client.request("prompts/list", {});
+    const promptNames = (listedPrompts.prompts || []).map((prompt) => prompt.name).sort();
+    const missingPrompts = requiredPrompts.filter((prompt) => !promptNames.includes(prompt));
 
     return {
-      ok: missingTools.length === 0,
+      ok: missingTools.length === 0 && missingResources.length === 0 && missingPrompts.length === 0,
       serverPath,
       protocolVersion: initialized.protocolVersion,
       toolCount: toolNames.length,
+      resourceCount: resourceUris.length,
+      promptCount: promptNames.length,
       tools: toolNames,
-      missingTools
+      resources: resourceUris,
+      prompts: promptNames,
+      missingTools,
+      missingResources,
+      missingPrompts
     };
   } finally {
     client.close();

package/src/lib/security.js

@@ -1,3 +1,5 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+
 const TOKEN_HEADER = "x-artifacty-token";
 
 const SECRET_PATTERNS = [
@@ -31,12 +33,23 @@ export function validateServerExposure({ host, config = securityConfig() }) {
   }
 }
 
+export function exposureWarning({ host, config = securityConfig() }) {
+  if (isLoopbackHost(host)) {
+    return "";
+  }
+  return [
+    `Warning: Artifacty is listening on ${host} in ${config.shareMode} share mode.`,
+    "HTTP is not encrypted by Artifacty; use only a trusted LAN/VPN or place it behind TLS.",
+    "Prefer x-artifacty-token or Authorization headers for scripts, and keep React rendering disabled unless every viewer trusts the artifact source."
+  ].join(" ");
+}
+
 export function requireToken({ request, url, body = {}, config = securityConfig() }) {
   if (!config.apiToken) {
     return;
   }
   const provided = extractToken({ request, url, body });
-  if (provided !== config.apiToken) {
+  if (!tokensEqual(provided, config.apiToken)) {
     throw Object.assign(new Error("Artifacty API token required"), {
       code: "AUTH_REQUIRED",
       statusCode: 401
@@ -87,6 +100,15 @@ export function assertNoSecrets(input = {}, options = {}) {
   };
 }
 
+export function tokensEqual(provided, expected) {
+  const providedText = String(provided ?? "");
+  const expectedText = String(expected ?? "");
+  const providedDigest = createHash("sha256").update(providedText).digest();
+  const expectedDigest = createHash("sha256").update(expectedText).digest();
+  return timingSafeEqual(providedDigest, expectedDigest) &&
+    Buffer.byteLength(providedText) === Buffer.byteLength(expectedText);
+}
+
 export function isLoopbackHost(host) {
   const normalized = String(host || "").toLowerCase();
   return normalized === "localhost" ||

package/src/mcp-server.js

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
+import { readFile } from "node:fs/promises";
+import path from "node:path";
 import readline from "node:readline";
+import { fileURLToPath } from "node:url";
 import {
   ARTIFACT_FORMATS,
   ARTIFACT_TYPES,
@@ -16,6 +19,7 @@ import { convertAgentArtifact } from "./lib/converters.js";
 import { resolvePublicBaseUrl } from "./lib/server-state.js";
 
 const PROTOCOL_VERSION = "2025-06-18";
+const PACKAGE_ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const store = createStore();
 
 const nativeArtifactInputSchema = {
@@ -255,6 +259,71 @@ const tools = [
   }
 ];
 
+const resourceTemplates = [
+  {
+    uriTemplate: "artifacty://artifacts/{id}",
+    name: "artifact-by-id",
+    title: "Artifact by ID",
+    description: "Read an Artifacty artifact with metadata, latest version, content, and browser URLs.",
+    mimeType: "application/json"
+  },
+  {
+    uriTemplate: "artifacty://artifacts/{id}/raw{?version}",
+    name: "artifact-raw-content",
+    title: "Artifact Raw Content",
+    description: "Read raw artifact content by ID and optional version.",
+    mimeType: "text/plain"
+  }
+];
+
+const prompts = [
+  {
+    name: "artifacty_handoff",
+    title: "Create Artifact Handoff",
+    description: "Prepare a concise continuation artifact for another agent.",
+    arguments: [
+      { name: "goal", description: "Current goal or handoff objective.", required: false },
+      { name: "artifactId", description: "Existing Artifacty artifact to continue from.", required: false }
+    ]
+  },
+  {
+    name: "artifacty_review",
+    title: "Create Review Artifact",
+    description: "Capture code review findings as a shareable Artifacty artifact.",
+    arguments: [
+      { name: "scope", description: "Files, branch, PR, or behavior under review.", required: false },
+      { name: "artifactId", description: "Existing artifact with review context.", required: false }
+    ]
+  },
+  {
+    name: "artifacty_test_report",
+    title: "Create Test Report Artifact",
+    description: "Summarize verification commands, status, failures, and residual risk.",
+    arguments: [
+      { name: "goal", description: "Feature or release being verified.", required: false },
+      { name: "artifactId", description: "Existing artifact with implementation context.", required: false }
+    ]
+  },
+  {
+    name: "artifacty_visual_qa",
+    title: "Create Visual QA Artifact",
+    description: "Record browser, screenshot, media, or visual regression evidence.",
+    arguments: [
+      { name: "target", description: "URL, artifact ID, or UI surface under visual review.", required: false },
+      { name: "artifactId", description: "Existing visual evidence artifact.", required: false }
+    ]
+  },
+  {
+    name: "artifacty_release_notes",
+    title: "Create Release Notes Artifact",
+    description: "Draft release notes from changed artifacts, tests, and known risks.",
+    arguments: [
+      { name: "version", description: "Release version.", required: false },
+      { name: "artifactId", description: "Existing roadmap, checklist, or handoff artifact.", required: false }
+    ]
+  }
+];
+
 const rl = readline.createInterface({
   input: process.stdin,
   crlfDelay: Infinity
@@ -311,14 +380,21 @@ async function handleRequest(message) {
       capabilities: {
         tools: {
           listChanged: false
+        },
+        resources: {
+          subscribe: false,
+          listChanged: false
+        },
+        prompts: {
+          listChanged: false
         }
       },
       serverInfo: {
         name: "artifacty",
         title: "Artifacty",
-        version: "0.3.0"
+        version: "0.4.0"
       },
-      instructions: "Use Artifacty to create, import, list, read, and update local artifacts that other agents can reuse."
+      instructions: "Use Artifacty to create, import, list, read, update, and resource-read local artifacts that other agents can reuse."
     };
   }
 
@@ -335,6 +411,27 @@ async function handleRequest(message) {
     return callTool(params.name, params.arguments || {});
   }
 
+  if (message.method === "resources/list") {
+    return listResources();
+  }
+
+  if (message.method === "resources/templates/list") {
+    return { resourceTemplates };
+  }
+
+  if (message.method === "resources/read") {
+    return readResource(requireParam(message.params, "uri"));
+  }
+
+  if (message.method === "prompts/list") {
+    return { prompts };
+  }
+
+  if (message.method === "prompts/get") {
+    const params = message.params || {};
+    return getPrompt(requireParam(params, "name"), params.arguments || {});
+  }
+
   throw Object.assign(new Error(`Method not found: ${message.method}`), {
     jsonRpcCode: -32601
   });
@@ -440,6 +537,177 @@ async function callTool(name, args) {
   });
 }
 
+async function listResources() {
+  const page = await listArtifactsPage(store, { limit: 10 });
+  const artifactResources = page.artifacts.flatMap((artifact) => [
+    {
+      uri: artifactResourceUri(artifact.id),
+      name: `artifact:${artifact.id}`,
+      title: artifact.title,
+      description: `${artifact.sourceAgent} ${artifact.artifactType} artifact, v${artifact.latestVersion}`,
+      mimeType: "application/json"
+    },
+    {
+      uri: artifactRawResourceUri(artifact.id),
+      name: `artifact-raw:${artifact.id}`,
+      title: `${artifact.title} raw`,
+      description: `Raw latest ${artifact.format || "text"} content for ${artifact.id}`,
+      mimeType: artifact.contentType || "text/plain"
+    }
+  ]);
+
+  return {
+    resources: [
+      {
+        uri: "artifacty://recent",
+        name: "recent-artifacts",
+        title: "Recent Artifacts",
+        description: "Recent Artifacty artifacts with pagination metadata and browser URLs.",
+        mimeType: "application/json"
+      },
+      {
+        uri: "artifacty://schema/v1",
+        name: "artifact-schema-v1",
+        title: "Artifact Schema v1",
+        description: "Artifacty schema v1 reference document.",
+        mimeType: "text/markdown"
+      },
+      ...artifactResources
+    ]
+  };
+}
+
+async function readResource(uri) {
+  if (uri === "artifacty://recent") {
+    const publicBaseUrl = await resolvePublicBaseUrl(store);
+    const page = await listArtifactsPage(store, { limit: 20 });
+    return resourceText(uri, "application/json", {
+      artifacts: page.artifacts.map((artifact) => ({
+        ...artifact,
+        url: `${publicBaseUrl}/artifacts/${encodeURIComponent(artifact.id)}`
+      })),
+      pagination: {
+        total: page.total,
+        limit: page.limit,
+        offset: page.offset,
+        hasMore: page.hasMore,
+        nextOffset: page.nextOffset,
+        previousOffset: page.previousOffset
+      },
+      search: page.search
+    });
+  }
+
+  if (uri === "artifacty://schema/v1") {
+    return {
+      contents: [
+        {
+          uri,
+          mimeType: "text/markdown",
+          text: await readFile(path.join(PACKAGE_ROOT, "docs", "artifact-schema-v1.md"), "utf8")
+        }
+      ]
+    };
+  }
+
+  const parsed = parseArtifactResourceUri(uri);
+  if (parsed) {
+    const artifact = await getArtifact(store, parsed.id, {
+      version: parsed.version,
+      audit: mcpAuditContext()
+    });
+    if (parsed.raw) {
+      return {
+        contents: [
+          {
+            uri,
+            mimeType: artifact.version.contentType || "text/plain",
+            text: artifact.content
+          }
+        ]
+      };
+    }
+    return resourceText(uri, "application/json", await withUrls(artifact));
+  }
+
+  throw Object.assign(new Error(`Unknown resource: ${uri}`), {
+    jsonRpcCode: -32602
+  });
+}
+
+function getPrompt(name, args) {
+  const definition = prompts.find((prompt) => prompt.name === name);
+  if (!definition) {
+    throw Object.assign(new Error(`Unknown prompt: ${name}`), {
+      jsonRpcCode: -32602
+    });
+  }
+
+  return {
+    description: definition.description,
+    messages: [
+      {
+        role: "user",
+        content: {
+          type: "text",
+          text: promptText(name, args)
+        }
+      }
+    ]
+  };
+}
+
+function promptText(name, args = {}) {
+  const context = args.artifactId
+    ? `First read Artifacty resource ${artifactResourceUri(args.artifactId)} and use it as context.`
+    : "Use the current session context and any relevant Artifacty resources.";
+  const common = `${context}
+
+Create or update an Artifacty artifact through artifacty_create, artifacty_import, or artifacty_update. Use concise Markdown unless another format is clearly better. Include sourceAgent, artifactType, and tags so another agent can discover it.`;
+
+  if (name === "artifacty_handoff") {
+    return `${common}
+
+Goal: ${args.goal || "Prepare a continuation handoff for the next agent."}
+
+Capture: current state, changed files or artifacts, commands run, decisions, blockers, residual risk, and next steps.
+Recommended artifactType: handoff. Recommended tags: handoff, continuation.`;
+  }
+  if (name === "artifacty_review") {
+    return `${common}
+
+Review scope: ${args.scope || "Review the current implementation or linked artifact."}
+
+Capture findings first, ordered by severity, with file/line references when available. Include open questions and verification gaps.
+Recommended artifactType: code-review. Recommended tags: review.`;
+  }
+  if (name === "artifacty_test_report") {
+    return `${common}
+
+Verification goal: ${args.goal || "Summarize test and smoke evidence."}
+
+Capture commands, status, failures, environment, manual checks, and what remains untested.
+Recommended artifactType: test-report. Recommended tags: verification, test-report.`;
+  }
+  if (name === "artifacty_visual_qa") {
+    return `${common}
+
+Visual target: ${args.target || "Inspect the UI or visual artifact under review."}
+
+Capture screenshots/media references, viewport, expected behavior, observed issues, and pass/fail verdict.
+Recommended artifactType: design-option or bundle. Recommended tags: visual, qa.`;
+  }
+  if (name === "artifacty_release_notes") {
+    return `${common}
+
+Release version: ${args.version || "next"}
+
+Capture highlights, breaking changes, migration notes, tests, known limitations, and publish evidence.
+Recommended artifactType: document. Recommended tags: release-notes.`;
+  }
+  return common;
+}
+
 async function createNativeArtifact(args) {
   return createArtifact(store, {
     title: args.title,
@@ -471,6 +739,49 @@ async function withUrls(artifact) {
   };
 }
 
+function resourceText(uri, mimeType, data) {
+  return {
+    contents: [
+      {
+        uri,
+        mimeType,
+        text: typeof data === "string" ? data : JSON.stringify(data, null, 2)
+      }
+    ]
+  };
+}
+
+function artifactResourceUri(id) {
+  return `artifacty://artifacts/${encodeURIComponent(id)}`;
+}
+
+function artifactRawResourceUri(id, version) {
+  const suffix = version ? `?version=${encodeURIComponent(String(version))}` : "";
+  return `artifacty://artifacts/${encodeURIComponent(id)}/raw${suffix}`;
+}
+
+function parseArtifactResourceUri(uri) {
+  let parsed;
+  try {
+    parsed = new URL(uri);
+  } catch {
+    return null;
+  }
+
+  if (parsed.protocol !== "artifacty:" || parsed.hostname !== "artifacts") {
+    return null;
+  }
+  const parts = parsed.pathname.split("/").filter(Boolean);
+  if (parts.length !== 1 && !(parts.length === 2 && parts[1] === "raw")) {
+    return null;
+  }
+  return {
+    id: decodeURIComponent(parts[0]),
+    raw: parts[1] === "raw",
+    version: parsed.searchParams.get("version") || undefined
+  };
+}
+
 function toolResult(data) {
   return {
     content: [
@@ -493,6 +804,15 @@ function requireArg(args, name) {
   return args[name];
 }
 
+function requireParam(params = {}, name) {
+  if (!params[name]) {
+    throw Object.assign(new Error(`Missing required parameter: ${name}`), {
+      jsonRpcCode: -32602
+    });
+  }
+  return params[name];
+}
+
 function writeResponse(id, result, error) {
   const response = {
     jsonrpc: "2.0",

package/src/server.js

@@ -19,7 +19,7 @@ import { convertAgentArtifact } from "./lib/converters.js";
 import { createLineDiff } from "./lib/diff.js";
 import { EDITOR_CLIENT_PATH, VIEWER_CLIENT_PATH, editorClientFilePath, editorVendorPath, viewerClientFilePath } from "./lib/editor-assets.js";
 import { localeFromBodyOrUrl, localeFromUrl, localizedHref } from "./lib/i18n.js";
-import { requireToken, securityConfig, validateServerExposure } from "./lib/security.js";
+import { exposureWarning, requireToken, securityConfig, validateServerExposure } from "./lib/security.js";
 import { writeServerState } from "./lib/server-state.js";
 import { generateToken } from "./lib/token.js";
 import {
@@ -78,6 +78,7 @@ export async function startServer(options = {}) {
     requestedPort,
     port: actualPort,
     portFallback: usedPortFallback,
+    securityWarning: exposureWarning({ host, config: security }),
     close: () => new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())))
   };
 }
@@ -674,12 +675,15 @@ async function runServerMain(options) {
     throw new Error("Use either --api-token or --generate-token, not both");
   }
   const generatedToken = options.generateToken ? generateToken(options) : null;
-  const { url, store } = await startServer({
+  const { url, store, securityWarning } = await startServer({
     ...options,
     apiToken: generatedToken?.token || options.apiToken
   });
   process.stderr.write(`Artifacty listening on ${url}\n`);
   process.stderr.write(`Store: ${store.home}\n`);
+  if (securityWarning) {
+    process.stderr.write(`${securityWarning}\n`);
+  }
   if (generatedToken) {
     process.stderr.write(`API token: ${generatedToken.token}\n`);
     process.stderr.write(`HTTP header: ${generatedToken.header}\n`);