mcp-server-mcpindex 0.3.7 → 0.3.8

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to `mcp-server-mcpindex` are recorded here.
 
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.8] - 2026-07-15
+
+### Fixed
+
+- **Empty `MCPINDEX_API_BASE` no longer breaks every API call.** Some MCPB-bundle hosts substitute an empty string for an unset optional `user_config` field, so `MCPINDEX_API_BASE=""` was being used verbatim as the base URL, turning every request into a broken relative URL. The base now falls back to `https://mcpindex.ai` on an empty value (`||` instead of `??`), so those hosts work out of the box. Source change was already on `main` at 0.3.7 but had not reached npm; this release ships it.
+
+### Changed
+
+- Swept em-dashes to hyphens in the `check_tool_trust` tool description and the update-check comments (house style).
+- Removed a no-op template expression in the recommendation output (`${r.name}@${r.qualityScore ? '' : ''}` always rendered `${r.name}`).
+
 ## [0.3.5] - 2026-07-12
 
 ### Changed

package/README.md

@@ -215,6 +215,10 @@ MIT.
 
 - Website: [mcpindex.ai](https://mcpindex.ai)
 - Methodology: [mcpindex.ai/methodology](https://mcpindex.ai/methodology)
+- Screen a server: [mcpindex.ai/screen](https://mcpindex.ai/screen)
+- Guide: [Find the right MCP server by task](https://mcpindex.ai/guides/find-mcp-server-by-task)
 - Source: [github.com/mcpindex-ai](https://github.com/mcpindex-ai)
 
+[![mcp-server-mcpindex MCP server](https://glama.ai/mcp/servers/mcpindex-ai/mcp-server-mcpindex/badges/score.svg)](https://glama.ai/mcp/servers/mcpindex-ai/mcp-server-mcpindex)
+
 Unofficial. Not affiliated with Anthropic.

package/manifest.json

@@ -0,0 +1,55 @@
+{
+  "manifest_version": "0.2",
+  "name": "mcp-server-mcpindex",
+  "display_name": "mcpindex",
+  "version": "0.3.8",
+  "description": "The MCP directory that vets servers, not just lists them: search by task, then get an advisory screen on a server before an agent calls its tools. Advisory, conformance monitored not enforced, not a safety verdict.",
+  "long_description": "mcpindex is the MCP directory that vets servers, not just lists them. Search by task to find the right server (ranked picks with install commands and quality scores), then get an advisory screen on a specific tool or a whole server before your agent calls it: whether each tool does what it claims. check_tool_trust and assess_server return an advisory verdict (REVIEW / UNVERIFIED at v1), backed by conformance monitoring and a live drift ledger, and fail closed to human review. Zero-config: queries the public mcpindex.ai API, no credentials. Monitored, not enforced; not a safety verdict and not an in-path gate.",
+  "author": {
+    "name": "Bhartis LLC",
+    "email": "hello@mcpindex.ai",
+    "url": "https://mcpindex.ai"
+  },
+  "homepage": "https://mcpindex.ai",
+  "documentation": "https://mcpindex.ai/methodology",
+  "support": "https://github.com/mcpindex-ai/mcpindex-web/issues",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mcpindex-ai/mcpindex-web"
+  },
+  "license": "MIT",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "discovery",
+    "trust",
+    "tool-safety",
+    "registry"
+  ],
+  "server": {
+    "type": "node",
+    "entry_point": "src/index.mjs",
+    "mcp_config": {
+      "command": "node",
+      "args": ["${__dirname}/src/index.mjs"],
+      "env": {
+        "MCPINDEX_API_BASE": "${user_config.api_base}"
+      }
+    }
+  },
+  "tools_generated": true,
+  "user_config": {
+    "api_base": {
+      "type": "string",
+      "title": "API base URL",
+      "description": "Override the mcpindex API base if you self-host. Leave as the default otherwise.",
+      "default": "https://mcpindex.ai",
+      "required": false
+    }
+  },
+  "compatibility": {
+    "runtimes": {
+      "node": ">=18.0.0"
+    }
+  }
+}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "mcp-server-mcpindex",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "mcpName": "io.github.gautamgb/mcp-server-mcpindex",
-  "description": "An MCP server for finding MCP servers, plus advisory screen verdicts (check_tool_trust, assess_server). Directory client - not the in-path gate (mcpindex-gate). Drop-in for Claude Desktop, Claude Code, Cursor, Gemini CLI, Cline, Zed.",
+  "description": "The MCP directory that vets servers, not just lists them. Search by task, then get an advisory screen on a server before your agent calls its tools: whether each tool does what it claims, backed by conformance monitoring and a public drift ledger. Advisory (REVIEW / UNVERIFIED), monitored not enforced, not a safety verdict. Drop-in for Claude Desktop, Claude Code, Cursor, Gemini CLI, Cline, Zed.",
   "keywords": [
     "mcp",
     "model-context-protocol",
@@ -38,12 +38,15 @@
     "src/",
     "README.md",
     "CHANGELOG.md",
-    "LICENSE"
+    "LICENSE",
+    "manifest.json"
   ],
   "scripts": {
     "build": "node --check src/index.mjs && node --check src/trust.mjs && node --check src/update-check.mjs",
     "test": "node --test test/*.test.mjs",
     "check-published": "node scripts/check-published.mjs",
+    "sync-glama": "node scripts/sync-glama-repo.mjs",
+    "bundle": "node scripts/bundle-mcpb.mjs",
     "release": "node scripts/release.mjs"
   },
   "dependencies": {

package/src/index.mjs

@@ -12,15 +12,18 @@ import { createRequire } from 'node:module';
 export { checkToolTrust, assessServer, VERDICT_CONTRACT_VERSION, V1_HONEST_LIMITS } from './trust.mjs';
 import { notifyUpdateIfAvailable } from './update-check.mjs';
 
-const API_BASE = process.env.MCPINDEX_API_BASE ?? 'https://mcpindex.ai';
-// Single source of truth for the running version — read from package.json so the
+// `||` (not `??`) so an empty MCPINDEX_API_BASE - which some MCPB hosts substitute
+// for an unset optional user_config field - falls back to the default instead of
+// becoming "" and breaking every fetch with a relative URL.
+const API_BASE = process.env.MCPINDEX_API_BASE || 'https://mcpindex.ai';
+// Single source of truth for the running version - read from package.json so the
 // User-Agent and the update-check can never drift from what npm actually shipped.
 const PKG_VERSION = createRequire(import.meta.url)('../package.json').version;
 
 const server = new Server(
   { name: 'mcp-server-mcpindex', version: PKG_VERSION },
   // Tools only. We do NOT advertise `logging`: the update notice goes to stderr (which
-  // every host surfaces), not via `notifications/message` (rendered inconsistently — Cursor
+  // every host surfaces), not via `notifications/message` (rendered inconsistently - Cursor
   // logs it as a bare ` undefined`). stderr is the universal, clean channel.
   { capabilities: { tools: {} } },
 );
@@ -106,7 +109,7 @@ const TOOLS = [
   {
     name: 'check_tool_trust',
     description:
-      'Pre-invocation advisory screen for a specific tool on an MCP server. Returns an advisory verdict object (directive ALLOW | DENY | REVIEW | UNVERIFIED, dimensions, freshness). At v1 the public screen produces REVIEW or UNVERIFIED only — ALLOW/DENY are reserved. Not the in-path gate (mcpindex-gate). Agents SHOULD treat UNVERIFIED as "human review required", never as ALLOW.',
+      'Pre-invocation advisory screen for a specific tool on an MCP server. Returns an advisory verdict object (directive ALLOW | DENY | REVIEW | UNVERIFIED, dimensions, freshness). At v1 the public screen produces REVIEW or UNVERIFIED only - ALLOW/DENY are reserved. Not the in-path gate (mcpindex-gate). Agents SHOULD treat UNVERIFIED as "human review required", never as ALLOW.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -227,7 +230,7 @@ function formatRecommend(data) {
   const lines = [`Top ${data.recommendations.length} for: "${data.task}"`, ''];
   for (const r of data.recommendations) {
     lines.push(`[${r.rank}] ${r.title}  ·  QS ${r.qualityScore}/100  ·  ${r.category}`);
-    lines.push(`    ${r.name}@${r.qualityScore ? '' : ''}`);
+    lines.push(`    ${r.name}`);
     lines.push(`    ${r.reasoning}`);
     const install = r.installs.npm
       ? `npx -y ${r.installs.npm}`
@@ -292,7 +295,7 @@ const transport = new StdioServerTransport();
 await server.connect(transport);
 console.error('[mcp-server-mcpindex] connected via stdio');
 
-// Fire-and-forget: tell the user if a newer version exists (stderr only — the channel
+// Fire-and-forget: tell the user if a newer version exists (stderr only - the channel
 // every host renders cleanly). Dropped onto the event loop AFTER connect so it can never
 // delay or crash startup; all errors are swallowed inside.
 notifyUpdateIfAvailable({ currentVersion: PKG_VERSION }).catch(() => {});

package/src/update-check.mjs

@@ -1,12 +1,12 @@
-// update-check.mjs — best-effort "a newer mcp-server-mcpindex exists" notice.
+// update-check.mjs - best-effort "a newer mcp-server-mcpindex exists" notice.
 //
 // Why this is safe to ship in a server that already egresses:
 //   - outbound to the PINNED npm registry host only, https, no redirect-following
 //     (no SSRF pivot), time-boxed, and fail-silent on ANY error;
-//   - fire-and-forget — it never blocks or crashes startup (the caller drops it
+//   - fire-and-forget - it never blocks or crashes startup (the caller drops it
 //     onto the event loop after connect and ignores rejections);
 //   - no telemetry beyond the standard registry GET (no version of the user, no
-//     machine id — just "what's the latest published version of this package");
+//     machine id - just "what's the latest published version of this package");
 //   - opt-out via MCPINDEX_NO_UPDATE_CHECK.
 //
 // Pure + injectable (fetchImpl) so it is unit-testable with no network.
@@ -88,11 +88,11 @@ export async function fetchLatestVersion({
 }
 
 /** Orchestration: check, and if a newer version exists, emit the notice to STDERR only.
- *  stderr is the UNIVERSAL channel — every MCP host (Cursor, Claude Desktop/Code, Gemini
+ *  stderr is the UNIVERSAL channel - every MCP host (Cursor, Claude Desktop/Code, Gemini
  *  CLI, …) surfaces a spawned server's stderr in its per-server log. We deliberately do NOT
  *  emit an MCP `notifications/message`: hosts render it inconsistently (Cursor logs it as a
  *  bare ` undefined`, swallowing the text), so it only adds noise where stderr already
- *  carries the message cleanly. Returns the message it emitted (or null) — handy for
+ *  carries the message cleanly. Returns the message it emitted (or null) - handy for
  *  tests/callers. Never throws; never blocks the caller (caller fire-and-forgets). */
 export async function notifyUpdateIfAvailable({
   currentVersion,
@@ -106,7 +106,7 @@ export async function notifyUpdateIfAvailable({
     const latest = await fetchLatestVersion({ pkg, fetchImpl });
     if (!latest || !isOlder(currentVersion, latest)) return null;
     const msg = formatUpdateMessage(currentVersion, latest);
-    log(msg); // stderr — the one channel every host renders cleanly
+    log(msg); // stderr - the one channel every host renders cleanly
     return msg;
   } catch {
     return null; // belt-and-suspenders: this path must never surface an error