curatedmcp 2.0.1 → 2.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +101 -59
  2. package/package.json +1 -1
package/README.md CHANGED
@@ -1,63 +1,85 @@
1
- # @curatedmcp/launcher
1
+ # curatedmcp
2
2
 
3
- [![npm version](https://img.shields.io/npm/v/@curatedmcp/launcher?color=brightgreen)](https://www.npmjs.com/package/@curatedmcp/launcher)
4
- [![npm downloads](https://img.shields.io/npm/dm/@curatedmcp/launcher)](https://www.npmjs.com/package/@curatedmcp/launcher)
5
- [![CI](https://github.com/oneprofile-dev/mcp-launcher/actions/workflows/test.yml/badge.svg)](https://github.com/oneprofile-dev/mcp-launcher/actions/workflows/test.yml)
3
+ [![npm version](https://img.shields.io/npm/v/curatedmcp?color=brightgreen)](https://www.npmjs.com/package/curatedmcp)
4
+ [![npm downloads](https://img.shields.io/npm/dm/curatedmcp)](https://www.npmjs.com/package/curatedmcp)
6
5
  [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
7
- [![Node.js ≥18](https://img.shields.io/node/v/@curatedmcp/launcher)](https://nodejs.org)
6
+ [![Node.js ≥18](https://img.shields.io/node/v/curatedmcp)](https://nodejs.org)
8
7
 
9
- > **The MCP Hub.** One config that bridges every AI agent (Claude, Cursor, Windsurf, Copilot, Gemini) to every MCP server you register.
8
+ > **The CuratedMCP Agent.** One CLI to **discover, run, audit, and govern** every MCP server your AI tools (Claude, Cursor, Windsurf, Copilot, Gemini) use.
10
9
 
11
10
  ```bash
12
- npx @curatedmcp/launcher init
11
+ # 10-second risk scan of your machine — no signup
12
+ npx curatedmcp audit
13
13
  ```
14
14
 
15
- **Plug it in once. Add servers anytime. Use them in any AI agent.**
15
+ **Plug it in once. Add servers anytime. Audit and govern them from one place.**
16
16
 
17
17
  ---
18
18
 
19
- ## Why
19
+ ## What you get
20
20
 
21
- If you use MCP servers across multiple AI clients, you've felt this pain:
21
+ | Command | What it does |
22
+ | --- | --- |
23
+ | `curatedmcp audit` | Scan your MCP configs for risky servers (high/medium/low). Zero auth, instant value. |
24
+ | `curatedmcp` *(no args)* | Run as an MCP hub server over stdio for Claude, Cursor, Windsurf, etc. |
25
+ | `curatedmcp add <slug>` | Add a server from the CuratedMCP catalog to your stack. |
26
+ | `curatedmcp remove <slug>` | Remove a server from your stack. |
27
+ | `curatedmcp list` | Show your current stack. |
28
+ | `curatedmcp init` | Print the config snippet to drop into your AI client. |
29
+ | `curatedmcp guard -- <cmd>` | Run a server behind the local action firewall. |
30
+ | `curatedmcp login` | Authenticate the agent to your CuratedMCP account. |
31
+ | `curatedmcp sync` | Pull your team's registry config and push audit results. |
22
32
 
23
- - You configure GitHub MCP in Claude Desktop. Then you switch to Cursor and have to do it again.
24
- - You add five servers to Claude. Want them in Windsurf too? Edit a different config file.
25
- - A new AI agent ships? Re-paste every server config from scratch.
33
+ ---
26
34
 
27
- **Launcher fixes that.** It's one MCP entry that fans out to every server you've added, in every AI client.
35
+ ## 1. Audit (the wedge — start here)
36
+
37
+ ```bash
38
+ npx curatedmcp audit
39
+ ```
40
+
41
+ Scans every MCP config file on your machine (Claude Desktop, Cursor, Windsurf, Claude Code, …),
42
+ classifies each server against the CuratedMCP catalog, and flags:
43
+
44
+ - 🔴 **HIGH** — unverified or known-risky servers with credentials
45
+ - 🟡 **MEDIUM** — verified servers running outside catalog defaults
46
+ - 🟢 **VERIFIED** — known-good catalog servers
47
+
48
+ No signup, no cloud, no data leaves your machine. Logged in? Add `--sync` to push the result to your dashboard.
49
+
50
+ ---
51
+
52
+ ## 2. Run as the MCP Hub
53
+
54
+ If you use MCP servers across multiple AI clients, you've felt this pain: configure GitHub MCP in
55
+ Claude Desktop, then re-do it in Cursor, then in Windsurf. New agent ships? Re-paste every config.
56
+
57
+ The agent fixes that. It's one MCP entry that fans out to every server you've added, in every AI client.
28
58
 
29
59
  ```
30
60
  Claude Cursor Windsurf Copilot Gemini
31
61
  \ \ | / /
32
62
  ┌──────────────────────────┐
33
- │ @curatedmcp/launcher │ ← one config in each agent
34
- │ (the MCP hub) │
63
+ │ curatedmcp │ ← one config in each agent
64
+ │ (the MCP hub) │
35
65
  └────┬──────┬──────┬───────┘
36
66
  │ │ │
37
- GitHub Postgres Stripe ← `launcher add`'d once, available everywhere
67
+ GitHub Postgres Stripe ← `add`'d once, available everywhere
38
68
  ```
39
69
 
40
- ---
41
-
42
- ## Install (60 seconds)
43
-
44
- ### 1. Add Launcher to your AI client
45
-
46
- Drop this entry into your MCP config:
70
+ ### Add it to your AI client
47
71
 
48
72
  ```json
49
73
  {
50
74
  "mcpServers": {
51
75
  "curatedmcp": {
52
76
  "command": "npx",
53
- "args": ["-y", "@curatedmcp/launcher"]
77
+ "args": ["-y", "curatedmcp"]
54
78
  }
55
79
  }
56
80
  }
57
81
  ```
58
82
 
59
- Config file location:
60
-
61
83
  | Client | Path |
62
84
  | --------------- | --------------------------------------------------------------------- |
63
85
  | Claude Desktop | `~/Library/Application Support/Claude/claude_desktop_config.json` (mac) / `%APPDATA%\Claude\claude_desktop_config.json` (win) |
@@ -65,17 +87,15 @@ Config file location:
65
87
  | Windsurf | `~/.codeium/windsurf/mcp_config.json` |
66
88
  | Claude Code | `~/.claude/mcp.json` (or `.claude/mcp.json` per-project) |
67
89
 
68
- ### 2. Add servers to your stack
90
+ ### Add servers to your stack
69
91
 
70
92
  ```bash
71
- npx @curatedmcp/launcher add github
72
- # Prompts for GITHUB_TOKEN
73
-
74
- npx @curatedmcp/launcher add postgres --env DATABASE_URL=postgres://...
75
- npx @curatedmcp/launcher list
93
+ npx curatedmcp add github # prompts for GITHUB_TOKEN
94
+ npx curatedmcp add postgres --env DATABASE_URL=postgres://...
95
+ npx curatedmcp list
76
96
  ```
77
97
 
78
- ### 3. Restart your AI client
98
+ ### Restart your AI client
79
99
 
80
100
  Tools appear with a `<slug>__` prefix:
81
101
 
@@ -83,39 +103,42 @@ Tools appear with a `<slug>__` prefix:
83
103
  - `postgres__query`
84
104
  - `filesystem__read_file`
85
105
 
86
- That's it. Add more servers any time — just `add` and restart.
87
-
88
106
  ---
89
107
 
90
- ## CLI Reference
108
+ ## 3. Guard (local action firewall)
91
109
 
110
+ ```bash
111
+ npx curatedmcp guard -- npx -y @modelcontextprotocol/server-github
92
112
  ```
93
- launcher # Run as MCP server (used by AI clients)
94
- launcher init # Print the config snippet for your AI client
95
- launcher add <slug> # Add a server from the CuratedMCP catalog
96
- --env KEY=value # Pre-supply env vars (otherwise prompted)
97
- launcher remove <slug> # Remove a server from your stack
98
- launcher list # Show your stack
99
- launcher --version # Print version
100
- launcher --help # Print help
113
+
114
+ Wraps an MCP server with a local policy engine that gates every `tools/call` against
115
+ `~/.curatedmcp/guard-policy.json`. Default policy allows read, prompts on write, blocks destructive.
116
+
117
+ ```bash
118
+ npx curatedmcp guard --dashboard --port 7878 -- npx -y @some/server
119
+ # Then open http://localhost:7878 for the live action log
101
120
  ```
102
121
 
103
122
  ---
104
123
 
105
- ## How it works
124
+ ## 4. Login + sync (for teams)
125
+
126
+ Once you have a CuratedMCP account, link the CLI to it:
106
127
 
107
- 1. Your AI client launches `npx @curatedmcp/launcher` over stdio (one MCP entry, like any other).
108
- 2. Launcher reads `~/.curatedmcp/stack.json` and **spawns each registered server as a child process** over stdio.
109
- 3. On `tools/list`, Launcher **aggregates** every child's tools and returns them prefixed with the server's slug.
110
- 4. On `tools/call`, Launcher **routes** the request to the matching child by name prefix and forwards the response unchanged.
128
+ ```bash
129
+ npx curatedmcp login # paste a registry key from your dashboard
130
+ npx curatedmcp sync # pull team registry config + push audit results
131
+ npx curatedmcp sync --team acme-eng # pick a specific team if you're in more than one
132
+ ```
111
133
 
112
- This makes Launcher invisible to the agent — it sees one MCP server with all the tools — while behind the scenes you've got N independent processes, isolated, each with its own credentials.
134
+ Sync pulls the locked-down server list approved by your team and merges it into your local stack —
135
+ so every developer's machine runs the same vetted set of servers.
113
136
 
114
137
  ---
115
138
 
116
- ## Config file
139
+ ## Config files
117
140
 
118
- `~/.curatedmcp/stack.json` — plain JSON, hand-editable, version-controllable:
141
+ `~/.curatedmcp/stack.json` — your stack, plain JSON, hand-editable, version-controllable:
119
142
 
120
143
  ```json
121
144
  {
@@ -135,11 +158,17 @@ This makes Launcher invisible to the agent — it sees one MCP server with all t
135
158
 
136
159
  Set `"disabled": true` on an entry to skip it without removing it.
137
160
 
161
+ Other files (created on first use):
162
+
163
+ - `~/.curatedmcp/auth.json` — login token (mode 0600)
164
+ - `~/.curatedmcp/guard-policy.json` — firewall policy
165
+ - `~/.curatedmcp/launcher.json` — anonymous client UUID
166
+
138
167
  ---
139
168
 
140
169
  ## In-agent discovery
141
170
 
142
- Launcher itself exposes 5 discovery tools to your AI client, so you can ask the agent:
171
+ The agent itself exposes discovery tools to your AI client, so you can ask:
143
172
 
144
173
  > "Find me an MCP server for Postgres."
145
174
  > "What's the best Stripe MCP?"
@@ -151,9 +180,9 @@ The agent uses `search_servers`, `get_server_details`, and `add_to_stack` to do
151
180
 
152
181
  ## Privacy
153
182
 
154
- - **All config is local** at `~/.curatedmcp/stack.json`. No cloud sync, no account.
183
+ - **All config is local** at `~/.curatedmcp/`. No cloud sync unless you `login`.
155
184
  - **Anonymous telemetry only** (event names like "search", "add"). Disable with `--no-telemetry` or `CURATOR_TELEMETRY=false`.
156
- - A persistent UUID is stored at `~/.curatedmcp/launcher.json` for de-duplication.
185
+ - Audit results stay on your machine unless you `login` and run `--sync`.
157
186
 
158
187
  ---
159
188
 
@@ -161,7 +190,20 @@ The agent uses `search_servers`, `get_server_details`, and `add_to_stack` to do
161
190
 
162
191
  - Works with Claude Desktop, Claude Code, Cursor, Windsurf, Copilot, Gemini, OpenAI Agents — anything that supports MCP over stdio.
163
192
  - Node.js ≥ 18.
164
- - Single dependency: `@modelcontextprotocol/sdk`.
193
+
194
+ ---
195
+
196
+ ## Migrating from the old packages
197
+
198
+ The agent replaces three earlier packages, which are now deprecated:
199
+
200
+ | Old | New |
201
+ | --- | --- |
202
+ | `@curatedmcp/launcher` | `curatedmcp` *(no args)* / `curatedmcp add` / `curatedmcp list` |
203
+ | `@curatedmcp/auditor` *(aka `mcp-audit`)* | `curatedmcp audit` |
204
+ | `@curatedmcp/sentinel` *(aka `sentinel`)* | `curatedmcp guard` |
205
+
206
+ A `launcher` bin alias is kept for back-compat.
165
207
 
166
208
  ---
167
209
 
@@ -169,7 +211,7 @@ The agent uses `search_servers`, `get_server_details`, and `add_to_stack` to do
169
211
 
170
212
  - 🌐 [curatedmcp.com/launcher](https://curatedmcp.com/launcher)
171
213
  - 📚 [Marketplace](https://curatedmcp.com/marketplace)
172
- - 🐙 [GitHub](https://github.com/curatedmcp/launcher)
173
- - 💬 [Issues](https://github.com/curatedmcp/launcher/issues)
214
+ - 🐙 [GitHub](https://github.com/oneprofile-dev/mcp-launcher)
215
+ - 💬 [Issues](https://github.com/oneprofile-dev/mcp-launcher/issues)
174
216
 
175
217
  MIT licensed.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "curatedmcp",
3
- "version": "2.0.1",
3
+ "version": "2.0.2",
4
4
  "description": "The CuratedMCP agent — discover, run, audit, and govern every MCP server your AI tools (Claude, Cursor, Windsurf, Copilot, Gemini) use",
5
5
  "license": "MIT",
6
6
  "type": "module",