bowmark-mcp 1.0.0 → 1.0.2

package/README.md

@@ -49,9 +49,15 @@ If your host speaks streamable HTTP, skip this bridge and connect directly to
 - **`?s=n` source code** is registered in `apps/api/src/mcp-sources.ts` +
   `mcp-registry/sources.json` (npm stdio bridge channel; the PyPI bridge is
   `?s=p`).
-- **The `mcp-name: ai.bowmark/bowmark` line above is load-bearing**: the
-  official MCP Registry validates npm package ownership by finding that
-  marker in the package README. Don't remove it.
+- **npm ownership verification needs BOTH markers — the registry checks the
+  published package.json, not just the README.** The `mcp-name:
+  ai.bowmark/bowmark` line above and the `"mcpName": "ai.bowmark/bowmark"`
+  field in `package.json` are both load-bearing; don't remove either. Learned
+  the hard way 2026-07-04: `release-mcp.yml`'s registry republish failed for
+  five straight api releases (`server returned status 400: ... "NPM package
+  'bowmark-mcp' is missing required 'mcpName' field"`) because only the
+  README marker was present — the package.json field is what `mcp-publisher
+  publish` actually validates against the live npm package.
 - **Versioning is manual** (thin bridge, not the api): bump `package.json`
   when it changes. Not wired into release-please; `private` is deliberately
   absent so npm publish works — release-please doesn't manage this package.
@@ -64,15 +70,25 @@ injected at the `callRemote`/`buildServer` seams.
 
 ## Publishing to npm
 
-**Live since 2026-07-04** (v0.1.0, published by CI + cold-verified via
+**Live since 2026-07-04** (published by CI + cold-verified via
 `npx -y bowmark-mcp` against prod). To ship a version: **bump `version` in
-`package.json` (and the two `version` literals in `src/bridge.ts`)
-and merge** — `.github/workflows/publish-bowmark-mcp.yml` compares the
-manifest against live npm on every merge touching this folder and publishes
-only when the version is new (requires the `NPM_TOKEN_BOWMARK_MCP` Actions
-secret; token lives in the 1Password item "npm bowmark-mcp publish token" —
-90-day expiry, so consider switching the workflow to npm Trusted Publishing).
-Not release-please; the bump IS the release action.
+`package.json` (and the two `version` literals in `src/bridge.ts`) and
+merge.** The actual publish does NOT run in this monorepo's CI — this repo
+is private, and npm Trusted Publishing (OIDC) validates against
+`package.json`'s `repository.url`, which (correctly) points at the public
+mirror `github.com/bowmark-ai/mcp`, not `Metroxe/bowmark`. So merging here
+only lands the version bump; `release-bowmark-mcp.yml` mirror-syncs it to
+`bowmark-ai/mcp`, and THAT repo's own `.github/workflows/publish.yml`
+(source-controlled at
+[`packages/bowmark-mcp/.github/workflows/publish.yml`](../.github/workflows/publish.yml)
+in this monorepo, mirrored in like any other file) does the real `npm
+publish`. Auth is npm **Trusted Publishing** (OIDC) — no token, configured
+on npmjs.com (package Settings → Trusted Publisher → GitHub Actions, repo
+`bowmark-ai/mcp`, workflow `publish.yml`). Publishing from the public
+mirror also auto-generates provenance attestations, which npm only produces
+for public-repo publishes — impossible from this private monorepo
+regardless of `repository.url`. Not release-please; the bump IS the release
+action.
 
 `mcp-registry/server.json` carries the matching npm `packages` entry (landed
 after the first publish per the mcp-name ordering rule), and the website

package/dist/bridge.js

@@ -35,7 +35,7 @@ export function authHeaders(env = process.env) {
     return key ? { "X-Bowmark-Key": key } : undefined;
 }
 async function withRemote(fn) {
-    const client = new Client({ name: "bowmark-mcp-bridge", version: "1.0.0" });
+    const client = new Client({ name: "bowmark-mcp-bridge", version: "1.0.2" });
     const headers = authHeaders();
     const transport = new StreamableHTTPClientTransport(new URL(targetUrl()), {
         requestInit: headers ? { headers } : undefined,
@@ -60,7 +60,7 @@ export async function callRemote(fn, connect = withRemote) {
     }
 }
 export function buildServer(remote = callRemote) {
-    const server = new Server({ name: "bowmark", version: "1.0.0" }, { capabilities: { tools: {} } });
+    const server = new Server({ name: "bowmark", version: "1.0.2" }, { capabilities: { tools: {} } });
     server.setRequestHandler(ListToolsRequestSchema, async () => {
         return await remote((c) => c.listTools());
     });

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "bowmark-mcp",
-  "version": "1.0.0",
+  "version": "1.0.2",
+  "mcpName": "ai.bowmark/bowmark",
   "description": "Bowmark MCP over stdio \u2014 a thin bridge to the hosted Bowmark MCP at https://api.bowmark.ai/mcp",
   "license": "MIT",
   "author": "Bowmark AI <christopher@bowmark.ai>",