forma-dsl-mcp 0.3.1 → 0.3.2

package/README.md

@@ -2,6 +2,7 @@
 
 [![Release](https://github.com/kalpak44/forma-dsl/actions/workflows/release.yml/badge.svg)](https://github.com/kalpak44/forma-dsl/actions/workflows/release.yml)
 [![npm](https://img.shields.io/npm/v/forma-dsl-mcp.svg)](https://www.npmjs.com/package/forma-dsl-mcp)
+[![M8ven Verified](https://m8ven.ai/api/agent-verify/badge?score=100)](https://m8ven.ai/verified/verify?id=d3529b4756004447)
 
 A [Model Context Protocol](https://modelcontextprotocol.io) server that knows
 [forma](https://www.npmjs.com/package/forma-dsl) — the declarative DSL for 3D solids — and
@@ -234,6 +235,21 @@ node packages/forma-dsl-mcp/src/bin.js     # the server, on stdio
 Point a client at `node /absolute/path/to/packages/forma-dsl-mcp/src/bin.js` to use the
 working tree rather than the published package.
 
+## Privacy
+
+This server makes **no network requests**. It imports no HTTP, socket or DNS module and calls
+no `fetch`; the geometry kernel is WebAssembly loaded from disk and the manual is bundled in
+this tarball, so it works with no network at all. There is no telemetry, no analytics, no
+update check and no account.
+
+It writes only inside the directories your client declares as MCP roots, never replaces a file
+unless told to, and leaves nothing elsewhere — no cache, no config, no logs.
+
+Your MCP client is a separate program with its own policy. Documents you ask a model to write
+travel wherever that client sends them, which this server neither controls nor sees.
+
+Full text: [PRIVACY.md](https://github.com/kalpak44/forma-dsl/blob/main/PRIVACY.md).
+
 ## License
 
 MIT — see [LICENSE](LICENSE).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forma-dsl-mcp",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "A stdio MCP server that knows the forma DSL and writes .forma documents that render.",
   "keywords": [
     "mcp",
@@ -46,7 +46,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.31.0",
-    "forma-dsl": "^0.3.1",
+    "forma-dsl": "^0.3.2",
     "zod": "^4.1.13"
   }
 }

package/src/tools.js

@@ -17,6 +17,25 @@ import { GUIDE_SECTIONS, guide } from './guide.js';
 import { PAGES, readPage, searchReference } from './reference.js';
 import { checkDocument, exportStl } from './document.js';
 
+/**
+ * What a tool that only reads what this package already carries is.
+ *
+ * All four hints are stated rather than just `readOnlyHint`, because the omitted ones are not
+ * absent: the specification gives `destructiveHint` a default of **true** and `idempotentHint`
+ * a default of **false**. A tool declaring neither is therefore advertising itself as
+ * destructive and unrepeatable — which, for a call that hands back a page of the manual, is
+ * simply untrue, and a cautious client is entitled to act on it.
+ *
+ * `openWorldHint` is false because every answer is bundled with the package. Nothing here
+ * reaches the network, so the domain is closed and stays closed offline.
+ */
+const READS_ONLY = Object.freeze({
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: false,
+});
+
 /**
  * Wraps text as a tool result.
  *
@@ -228,7 +247,7 @@ function registerGuide(server) {
       section: z.enum(/** @type {[string, ...string[]]} */ (GUIDE_SECTIONS)).optional()
         .describe('One section, instead of the whole guide.'),
     },
-    annotations: { readOnlyHint: true, openWorldHint: false },
+    annotations: READS_ONLY,
   }, async ({ section }) => attempt(async () => say(guide(section))));
 }
 
@@ -256,7 +275,7 @@ function registerBlocks(server) {
       group: z.string().optional()
         .describe('One group, e.g. "2D shapes", "Transforms", "Refinement", "Declarations".'),
     },
-    annotations: { readOnlyHint: true, openWorldHint: false },
+    annotations: READS_ONLY,
   }, async ({ names, group }) => attempt(async () => {
     const all = [...CONSTRUCTS.values()];
 
@@ -312,7 +331,7 @@ function registerFunctions(server) {
       'Every function an expression may call, with its arity, and the two named constants. '
       + 'There are no user-defined functions in forma, so this is the complete set.',
     inputSchema: {},
-    annotations: { readOnlyHint: true, openWorldHint: false },
+    annotations: READS_ONLY,
   }, async () => attempt(async () => say([
     '# Functions',
     '',
@@ -350,7 +369,7 @@ function registerReference(server) {
       query: z.string().optional().describe('Words to search for, e.g. "revolve profile axis".'),
       page: z.string().optional().describe('One page to read, e.g. "reference/conversions.md".'),
     },
-    annotations: { readOnlyHint: true, openWorldHint: false },
+    annotations: READS_ONLY,
   }, async ({ query, page }) => attempt(async () => {
     if (page) {
       const found = await readPage(page);
@@ -400,7 +419,7 @@ function registerExamples(server) {
     inputSchema: {
       name: z.string().optional().describe('One example to read in full.'),
     },
-    annotations: { readOnlyHint: true, openWorldHint: false },
+    annotations: READS_ONLY,
   }, async ({ name }) => attempt(async () => {
     if (name) {
       const example = EXAMPLES_BY_NAME.get(name);
@@ -505,7 +524,7 @@ function registerRead(server, workspace) {
       solve: z.boolean().optional()
         .describe('Run the geometry kernel. Default true; false parses only, which is faster.'),
     },
-    annotations: { readOnlyHint: true, openWorldHint: false },
+    annotations: READS_ONLY,
   }, async ({ path, solve }) => attempt(async () => {
     const source = await workspace.read(path);
     const report = await checkDocument(source, { solve: solve ?? true });