mcp-stitch 0.1.0 → 0.1.2

package/LICENSE

@@ -0,0 +1,15 @@
+ISC License
+
+Copyright (c) 2026 Jason McAlpin
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/README.md

@@ -2,11 +2,52 @@
 
 MCP server for Google Stitch. It exposes Stitch project, screen, design-system, generation, edit, variant, and artifact export tools over stdio for VS Code and other MCP-compatible agents.
 
+## Contents
+
+- [Links](#links)
+- [Status](#status)
+- [Requirements](#requirements)
+- [Install](#install)
+- [Environment](#environment)
+- [VS Code Setup](#vs-code-setup)
+- [Cursor Setup](#cursor-setup)
+- [Continue Setup](#continue-setup)
+- [Codex Setup](#codex-setup)
+- [Tools](#tools)
+- [Safety](#safety)
+- [Development](#development)
+- [Release Script](#release-script)
+- [Contributing](#contributing)
+- [Security](#security)
+- [License](#license)
+- [Publishing Checklist](#publishing-checklist)
+
+## Links
+
+- npm: https://www.npmjs.com/package/mcp-stitch
+- GitHub: https://github.com/jasonmcalpin/mcp-stitch
+- Google Stitch: https://stitch.withgoogle.com/
+- Model Context Protocol: https://modelcontextprotocol.io/
+
+## Status
+
+Early public release. The server is usable, but the Stitch API surface may evolve.
+
 ## Requirements
 
 - Node.js 20 or newer
 - A Google API key with access to Stitch
 
+## Install
+
+Most MCP clients can run this package with `npx`:
+
+```bash
+npx -y mcp-stitch
+```
+
+You normally do not run that command directly in a terminal. Add it to your MCP client configuration as shown below.
+
 ## Environment
 
 Required:
@@ -80,8 +121,124 @@ For local development before publishing, build this repo and point VS Code at th
 }
 ```
 
+Open the VS Code Command Palette with `Cmd+Shift+P` on macOS or `Ctrl+Shift+P` on Windows/Linux, then run `MCP: List Servers` to start or restart the server.
+
 After VS Code starts the server, ask your agent to call `stitch_status` to confirm the setup.
 
+## Cursor Setup
+
+In Cursor, open `Cursor Settings > MCP` and add a new server:
+
+- Name: `stitch`
+- Type / Transport: `stdio`
+- Command: `npx`
+- Arguments:
+  - `-y`
+  - `mcp-stitch`
+
+Environment variables:
+
+- `GOOGLE_API_KEY`: your Google API key
+- `PROJECT_ROOT`: absolute path to the project where artifacts should be exported
+
+Cursor may not expand VS Code variables like `${workspaceFolder}`, so use a real absolute path for `PROJECT_ROOT`, for example:
+
+```text
+/Users/you/Workspace/my-project
+```
+
+You can also use Cursor's MCP JSON config:
+
+```json
+{
+  "mcpServers": {
+    "stitch": {
+      "command": "npx",
+      "args": ["-y", "mcp-stitch"],
+      "env": {
+        "GOOGLE_API_KEY": "your-key-here",
+        "PROJECT_ROOT": "/absolute/path/to/your/project"
+      }
+    }
+  }
+}
+```
+
+After adding it, ask Cursor Agent to call `stitch_status`.
+
+## Continue Setup
+
+Continue supports MCP servers in Agent mode. One local setup option is to create a file like:
+
+```text
+.continue/mcpServers/stitch.yaml
+```
+
+Example:
+
+```yaml
+name: Stitch MCP
+version: 0.1.0
+schema: v1
+
+mcpServers:
+  - name: Stitch
+    type: stdio
+    command: npx
+    args:
+      - "-y"
+      - "mcp-stitch"
+    env:
+      GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+      PROJECT_ROOT: /absolute/path/to/your/project
+```
+
+Use Continue's secrets or your local environment for `GOOGLE_API_KEY`; do not commit a literal key.
+
+## Codex Setup
+
+In the Codex app, add a new MCP server with the `+` button:
+
+- Name: `stitch`
+- Transport: `STDIO`
+- Command to launch: `npx`
+- Arguments:
+  - `-y`
+  - `mcp-stitch`
+
+Environment variables:
+
+- `GOOGLE_API_KEY`: your Google API key
+- `PROJECT_ROOT`: absolute path to the project where artifacts should be exported
+
+Codex may not expand VS Code variables like `${workspaceFolder}`, so use a real absolute path for `PROJECT_ROOT`, for example:
+
+```text
+/Users/you/Workspace/my-project
+```
+
+After adding the server, restart or reconnect it and ask Codex to call `stitch_status`.
+
+For Codex CLI or manual setup, add a stdio MCP server to your Codex config, usually:
+
+```text
+~/.codex/config.toml
+```
+
+Example:
+
+```toml
+[mcp_servers.stitch]
+command = "npx"
+args = ["-y", "mcp-stitch"]
+
+[mcp_servers.stitch.env]
+GOOGLE_API_KEY = "your-key-here"
+PROJECT_ROOT = "/absolute/path/to/your/project"
+```
+
+Keep this in your local Codex config if it contains a real API key.
+
 ## Tools
 
 - `stitch_status`
@@ -103,6 +260,15 @@ After VS Code starts the server, ask your agent to call `stitch_status` to confi
 
 Mutating tools require `confirm: true`.
 
+## Safety
+
+- Secrets are read from environment variables and are not printed by `stitch_status`.
+- `STITCH_API_BASE_URL` defaults to Google's Stitch MCP endpoint.
+- Artifact export paths are constrained to `PROJECT_ROOT` or `STITCH_OUTPUT_DIR`.
+- Mutating Stitch tools require `confirm: true`.
+
+Do not commit `.env`, generated artifact bundles, or Stitch output directories. This repo's `.gitignore` excludes the common local output paths.
+
 ## Development
 
 ```bash
@@ -111,12 +277,45 @@ npm run build
 npm run dev
 ```
 
-## Publishing Checklist
+## Release Script
+
+Maintainers can publish a release and push the matching Git commit/tag with:
+
+```bash
+npm run release
+```
+
+The script defaults to a patch release. You can pass another npm version bump:
+
+```bash
+npm run release -- minor
+```
+
+It runs `npm version`, builds, previews the npm package, asks for confirmation before publishing, then commits, tags, and pushes the release.
+
+## Contributing
+
+Issues and pull requests are welcome. Please keep changes focused on the Stitch MCP server surface, avoid committing generated Stitch artifacts, and run:
 
 ```bash
 npm run build
 npm pack --dry-run
-npm publish
+```
+
+before opening a pull request.
+
+## Security
+
+Please do not open public issues containing API keys, private project IDs, exported Stitch payloads, or other sensitive data. If a report requires private details, open a minimal issue first and note that you need a private disclosure path.
+
+## License
+
+ISC. See [LICENSE](LICENSE).
+
+## Publishing Checklist
+
+```bash
+npm run release
 ```
 
 See [docs/stitch-tools.md](docs/stitch-tools.md) for detailed tool inputs and Stitch contract notes.

package/package.json

@@ -1,20 +1,31 @@
 {
   "name": "mcp-stitch",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "MCP server for Google Stitch.",
   "main": "dist/index.js",
   "bin": {
     "mcp-stitch": "./dist/index.js"
   },
+  "homepage": "https://github.com/jasonmcalpin/mcp-stitch#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jasonmcalpin/mcp-stitch.git"
+  },
+  "bugs": {
+    "url": "https://github.com/jasonmcalpin/mcp-stitch/issues"
+  },
   "files": [
     "dist",
     "docs/stitch-tools.md",
-    "README.md"
+    "README.md",
+    "LICENSE",
+    "scripts/release.sh"
   ],
   "scripts": {
     "dev": "tsx src/index.ts",
     "build": "tsc",
     "prepack": "npm run build",
+    "release": "bash scripts/release.sh",
     "start": "node dist/index.js"
   },
   "keywords": [
@@ -24,7 +35,7 @@
     "google-stitch",
     "vscode"
   ],
-  "author": "",
+  "author": "Jason McAlpin",
   "license": "ISC",
   "type": "module",
   "dependencies": {

package/scripts/release.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+VERSION_BUMP="${1:-patch}"
+NPM_CACHE="${NPM_CACHE:-/private/tmp/mcp-stitch-npm-cache}"
+
+case "$VERSION_BUMP" in
+  patch|minor|major|prepatch|preminor|premajor|prerelease)
+    ;;
+  *)
+    echo "Invalid version bump: $VERSION_BUMP"
+    echo "Use one of: patch, minor, major, prepatch, preminor, premajor, prerelease"
+    exit 1
+    ;;
+esac
+
+if ! git diff --quiet || ! git diff --cached --quiet; then
+  echo "Working tree has uncommitted changes. That is okay for a release,"
+  echo "but they will be included in the release commit after publish."
+  echo
+fi
+
+echo "Release bump: $VERSION_BUMP"
+echo "npm cache: $NPM_CACHE"
+echo
+
+read -r -p "Commit message: " COMMIT_MESSAGE
+if [[ -z "${COMMIT_MESSAGE// }" ]]; then
+  echo "Commit message is required."
+  exit 1
+fi
+
+echo
+echo "Bumping package version..."
+npm version "$VERSION_BUMP" --no-git-tag-version
+
+VERSION="$(node -p "require('./package.json').version")"
+TAG="v$VERSION"
+
+echo
+echo "Building..."
+npm run build
+
+echo
+echo "Checking package contents..."
+npm --cache "$NPM_CACHE" pack --dry-run
+
+echo
+read -r -p "Publish mcp-stitch@$VERSION to npm? [y/N] " CONFIRM_PUBLISH
+case "$CONFIRM_PUBLISH" in
+  y|Y|yes|YES)
+    npm --cache "$NPM_CACHE" publish --access public
+    ;;
+  *)
+    echo "Publish cancelled. Version files were updated but no npm package was published."
+    exit 1
+    ;;
+esac
+
+echo
+echo "Committing and pushing..."
+git add .
+git commit -m "$COMMIT_MESSAGE"
+git tag "$TAG"
+git push
+git push origin "$TAG"
+
+echo
+echo "Released mcp-stitch@$VERSION and pushed $TAG."