mcp-researchpowerpack 7.0.15 → 7.1.1

package/README.md

@@ -5,9 +5,11 @@
 http mcp server for research. five tools, orientation-first, built for agents
 that run multi-pass research loops.
 
-ships on [`mcp-use`](https://github.com/nicepkg/mcp-use). every external call
-flows through an effect ts service layer for typed concurrency, typed errors,
-and timeouts that actually mean something. no stdio — http only.
+ships on [`mcp-use`](https://github.com/nicepkg/mcp-use). tool-level provider
+and llm orchestration flows through effect ts service layers for typed
+concurrency, typed errors, scoped kernel cleanup, and step timeouts. provider
+clients remain small promise/sdk adapters behind those layers. no stdio — http
+only.
 
 ## tools
 
@@ -76,18 +78,20 @@ or skip the install entirely and hit the hosted deployment at
 
 ## config
 
-copy `.env.example`, set only what you need. missing keys don't crash the
-server — they disable the affected capability with a clear error at call time.
+copy `.env.example`, set only what you need. blank/whitespace keys are treated
+as absent. missing keys don't crash the server — they disable the affected
+capability with a clear error at call time.
 
 ### server
 
 | var | default | |
 |-----|---------|---|
 | `PORT` | `3000` | http port |
-| `HOST` | `127.0.0.1` | bind address; cloud runtimes that set `PORT` auto-switch to `0.0.0.0` |
-| `ALLOWED_ORIGINS` | unset | comma-separated origins for host validation / cors |
-| `MCP_URL` | unset | fallback public mcp url used by the production origin-protection guard |
-| `NODE_ENV` | unset | set to `production` to enforce `ALLOWED_ORIGINS` or `MCP_URL` (server exits otherwise) |
+| `HOST` | `127.0.0.1` | bind address; cloud runtimes that set `PORT` auto-switch to `0.0.0.0`. public binds require `ALLOWED_ORIGINS`, `MCP_URL`, or `CSP_URLS` |
+| `ALLOWED_ORIGINS` | unset | comma-separated origins for host validation / cors; merged with `MCP_URL` and platform `CSP_URLS` when present |
+| `MCP_URL` | unset | public mcp url; contributes its origin to host validation and well-known resource urls |
+| `CSP_URLS` | unset | platform-provided comma-separated public origins; also contributes to host validation |
+| `NODE_ENV` | unset | `production` also requires `ALLOWED_ORIGINS`, `MCP_URL`, or `CSP_URLS`, even on a local bind |
 | `DEBUG` | unset | `1` or `2` to bump mcp-use debug verbosity |
 
 ### providers
@@ -117,6 +121,7 @@ are required together. reasoning effort is hardcoded to `low`.
 ### concurrency
 
 all optional. provider limits are clamped 1–200; kernel is clamped 1–20.
+malformed numeric values are rejected instead of partially parsed.
 
 | var | default | controls |
 |-----|---------|----------|
@@ -146,11 +151,16 @@ useful env vars:
 pnpm install
 pnpm dev          # watch mode, serves :3000/mcp
 pnpm typecheck    # tsc --noEmit
+pnpm test:unit    # deterministic unit tests
+pnpm test:http    # local http / mcp integration test
 pnpm test         # unit + http integration tests
 pnpm build        # compile to dist/
 pnpm inspect      # mcp-use inspector
 ```
 
+`prepublishOnly` runs `pnpm typecheck`, `pnpm test:unit`, `pnpm test:http`,
+and `pnpm build`, matching the required publish gate.
+
 ## deploy
 
 deploy to manufact cloud via the `mcp-use` cli (github-backed):
@@ -166,6 +176,8 @@ or self-host anywhere with node 20.19+ / 22.12+:
 
 ```bash
 HOST=0.0.0.0 ALLOWED_ORIGINS=https://app.example.com pnpm start
+# or derive production origin protection from the public mcp url:
+NODE_ENV=production MCP_URL=https://research.example.com/mcp pnpm start
 ```
 
 ## architecture
@@ -175,8 +187,8 @@ index.ts                 server startup, cors, health, shutdown
 src/
   config/                env parsing, capability detection, lazy proxy config
   effect/                typed service tags + Live layers; runExternalEffect()
-                         is the single boundary tool handlers cross to talk
-                         to the outside world
+                         only accepts fully-provided programs at the async
+                         tool boundary
   clients/               provider api clients (serper, jina, kernel, reddit,
                          scrapedo) — wrapped by Live layers in src/effect/
   tools/
@@ -204,9 +216,9 @@ key patterns: capability detection at startup, description-led tool routing
 raw/smart tool split, tiered classified output in `smart-web-search`, reddit
 api routing in scrape tools, jina reader first for non-reddit urls,
 scrape.do proxy-mode retry through `X-Proxy-Url`, optional kernel
-browser-render fallback, bounded concurrency via `Effect.forEach`, ctr-based
-url ranking, tools never throw (always return `toolFailure`), and structured
-errors with retry classification.
+browser-render fallback with scoped session cleanup, bounded concurrency via
+`Effect.forEach`, ctr-based url ranking, tools never throw (always return
+`toolFailure`), and structured errors with retry classification.
 
 ## license