mcplane 0.1.0

package/dist/packs.js

@@ -0,0 +1,278 @@
+/**
+ * Submission packs: everything a store's form asks for, in its order, checked
+ * against its limits. ChatGPT gets the chatgpt-app-submission.json its portal
+ * imports (the format OpenAI's own chatgpt-app-submission skill writes); the
+ * rest get a markdown pack to paste from.
+ */
+import { mkdir, writeFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { ensureLocalDir } from './manifest.js';
+import { McpClient } from './mcp-client.js';
+const CATEGORIES = ['BUSINESS', 'COLLABORATION', 'DESIGN', 'DEVELOPER_TOOLS', 'EDUCATION', 'ENTERTAINMENT', 'FINANCE', 'FOOD', 'LIFESTYLE', 'NEWS', 'PRODUCTIVITY', 'SHOPPING', 'TRAVEL'];
+const MAX_JUSTIFICATION = 200; // the ChatGPT form cuts longer ones without warning
+async function listTools(m, token) {
+    const c = new McpClient(m.server.url, token ? { authorization: `Bearer ${token}` } : {});
+    const init = await c.initialize();
+    if (init.status >= 400)
+        throw new Error(`Couldn't read tools from ${m.server.url} (HTTP ${init.status})${m.server.auth === 'oauth' ? '; pass --token' : ''}.`);
+    const r = await c.request('tools/list');
+    return (r.body?.result?.tools ?? []);
+}
+const firstSentence = (s = '') => (s.match(/^[^.!?]+[.!?]/)?.[0] ?? s).trim();
+const VERBS = /^(add|create|get|fetch|list|search|find|update|edit|delete|remove|send|post|publish|mark|set|run|check|look|read|write|upload|download|report|record|submit|start|stop|cancel|return|generate|compare|show|save|share|move|copy|open|close|resolve|restore)\b/i;
+/** "Add the user's…" → "adds the user's…"; leaves non-verb openings alone. */
+function thirdPerson(s) {
+    const m = s.match(VERBS);
+    if (!m)
+        return null;
+    const w = m[1].toLowerCase();
+    const conj = /(s|sh|ch|x|z)$/.test(w) ? `${w}es` : /[^aeiou]y$/.test(w) ? `${w.slice(0, -1)}ies` : `${w}s`;
+    return conj + s.slice(m[1].length);
+}
+const possessive = (name) => (name.endsWith('s') ? `${name}'` : `${name}'s`);
+const clip = (s, n) => (s.length <= n ? s : `${s.slice(0, n - 1).replace(/\s+\S*$/, '')}…`);
+const lower = (s) => s.charAt(0).toLowerCase() + s.slice(1);
+/** One-sentence drafts from the declared hints and the tool's own description. Review them: they are a start, not an answer. */
+function justify(t, product, own) {
+    const a = t.annotations ?? {};
+    const sentence = firstSentence(t.description).replace(/\.$/, '');
+    const verb = thirdPerson(sentence);
+    const what = verb ? `it ${verb}` : `the tool: ${lower(sentence)}`;
+    return {
+        read_only_justification: clip(own?.readOnly ?? (a.readOnlyHint ? 'Only looks up and returns data; it does not create, change or delete anything.' : `Writes data: ${what}.`), MAX_JUSTIFICATION),
+        open_world_justification: clip(own?.openWorld ?? (a.openWorldHint ? `Can change public or third-party state: ${what}.` : `Works only within ${possessive(product)} own service; it does not post, publish or send anything elsewhere.`), MAX_JUSTIFICATION),
+        destructive_justification: clip(own?.destructive ??
+            (a.destructiveHint ? `Can delete or overwrite data: it ${what}.` : a.readOnlyHint ? 'Read-only, so it cannot delete or overwrite anything.' : 'Only adds or updates the user’s own data; it never deletes or overwrites existing records.'), MAX_JUSTIFICATION),
+    };
+}
+export async function chatgptPack(m, token) {
+    const tools = await listTools(m, token);
+    const problems = [];
+    const todo = [];
+    const category = (m.category ?? '').toUpperCase().replace(/[^A-Z]+/g, '_');
+    if (!CATEGORIES.includes(category))
+        problems.push(`category "${m.category ?? ''}" isn't one of ChatGPT's: ${CATEGORIES.join(', ')}`);
+    if ((m.subtitle ?? '').length > 30)
+        problems.push(`subtitle is ${m.subtitle.length} characters; the limit is 30`);
+    if (!m.subtitle)
+        problems.push('subtitle is missing (30 characters, a plain functional phrase)');
+    const missingHints = tools.filter((t) => ['readOnlyHint', 'openWorldHint', 'destructiveHint'].some((h) => typeof t.annotations?.[h] !== 'boolean'));
+    for (const t of missingHints)
+        problems.push(`${t.name} doesn't set all three hints; ChatGPT treats that as a blocker`);
+    const toolsOut = Object.fromEntries(tools.map((t) => [
+        t.name,
+        {
+            annotations: {
+                readOnlyHint: !!t.annotations?.readOnlyHint,
+                openWorldHint: !!t.annotations?.openWorldHint,
+                destructiveHint: !!t.annotations?.destructiveHint,
+            },
+            justifications: justify(t, m.title, m.justifications?.[t.name]),
+        },
+    ]));
+    const drafted = tools.filter((t) => !m.justifications?.[t.name]).map((t) => t.name);
+    if (drafted.length)
+        todo.push(`Read the drafted justifications for ${drafted.join(', ')}: they come from your hints and tool descriptions. Once they say exactly what each tool changes, save them under "justifications" in mcplane.json so every version reuses them.`);
+    for (const [name, j] of Object.entries(m.justifications ?? {}))
+        for (const [k, v] of Object.entries(j))
+            if (v && v.length > MAX_JUSTIFICATION)
+                problems.push(`justifications.${name}.${k} is ${v.length} characters; ChatGPT cuts at ${MAX_JUSTIFICATION}`);
+    const pos = m.tests?.positive ?? [];
+    const neg = m.tests?.negative ?? [];
+    const names = new Set(tools.map((t) => t.name));
+    if (pos.length !== 5)
+        problems.push(`tests.positive has ${pos.length}; ChatGPT needs exactly 5`);
+    if (neg.length !== 3)
+        problems.push(`tests.negative has ${neg.length}; ChatGPT needs exactly 3`);
+    for (const p of pos)
+        for (const n of p.tools)
+            if (!names.has(n))
+                problems.push(`test "${p.scenario}" names a tool the server doesn't have: ${n}`);
+    const covered = new Set(pos.flatMap((p) => p.tools));
+    for (const t of tools)
+        if (!covered.has(t.name))
+            todo.push(`No positive test uses ${t.name}. Reviewers check every tool.`);
+    const json = {
+        $schema: 'https://developers.openai.com/apps-sdk/schemas/chatgpt-app-submission.v1.json',
+        schema_version: 1,
+        app_info: { display_name: m.title, subtitle: m.subtitle ?? '', description: m.description ?? '', category: CATEGORIES.includes(category) ? category : 'PRODUCTIVITY' },
+        tools: toolsOut,
+        ...(pos.length
+            ? {
+                test_cases: pos.map((p) => ({ description: p.scenario, user_prompt: p.prompt, file_attachment_urls: null, tools_triggered: p.tools.join(', '), expected_output: p.expected, expected_output_url: null })),
+            }
+            : {}),
+        ...(neg.length
+            ? {
+                negative_test_cases: neg.map((n) => ({ description: n.scenario, user_prompt: n.prompt, file_attachment_urls: null, tools_triggered: null, expected_output: `${m.title} should not be invoked.`, expected_output_url: null })),
+            }
+            : {}),
+    };
+    const steps = `# ChatGPT submission: ${m.title}
+
+Upload \`chatgpt-app-submission.json\` on the Info step ("Use Codex to fill this form"): it fills app info, tool justifications and tests.
+
+## Before you start
+- A verified organisation on platform.openai.com (Settings, Organization). Start early; it can lag.
+- Domain challenge: the MCP step gives you a token to serve as plain text at ${new URL(m.server.url).origin}/.well-known/openai-apps-challenge.
+- A demo video recorded in ChatGPT developer mode showing the tools your tests use, hosted as an .mp4 URL.
+- Icons: a directory icon (square PNG, 256 px or more) and a composer icon (48 px or more; the developer-mode dialog caps uploads at 10 KB).
+
+## Fields the JSON doesn't cover
+- Developer identity and Plugin Author: must match your verified legal or business name.
+- Website: ${m.links?.website ?? 'MISSING'}
+- Customer support URL (a URL, not an email): ${m.links?.support ?? 'MISSING'}
+- Privacy policy: ${m.links?.privacy ?? 'MISSING'}
+- Terms: ${m.links?.terms ?? 'MISSING'}
+- MCP server URL: ${m.server.url} (${m.server.auth === 'oauth' ? 'OAuth' : 'No Auth'})${m.server.auth === 'oauth' ? `\n- Test credentials: ${m.reviewerAccess ?? 'MISSING: an email-and-password demo account with no 2FA, seeded for every test case'}` : ''}
+- Prompts (up to 3): ${(m.prompts ?? []).slice(0, 3).map((p) => `"${p}"`).join(', ') || 'none set'}
+
+## Traps
+- Run "Scan Tools" twice if the first click shows nothing.
+- Justifications over 200 characters are cut without warning.
+- Typing into fields while the draft autosaves can drop characters; re-read before submitting.
+- "Submit for Review" shows nothing for about 20 seconds. Confirm on the plugins list that the version reads "Review".
+- One version can be in review at a time. Changing tools on a published plugin needs a new version.
+
+When it's in: \`mcplane submitted chatgpt --app-id <asdk_app_… from the URL>\`
+`;
+    return {
+        files: [
+            { path: 'chatgpt-app-submission.json', content: JSON.stringify(json, null, 2) + '\n' },
+            { path: 'chatgpt.md', content: steps },
+        ],
+        problems,
+        todo,
+    };
+}
+function readWrite(tools) {
+    const writes = tools.filter((t) => t.annotations?.readOnlyHint === false);
+    if (!writes.length)
+        return 'Read only';
+    return writes.length === tools.length ? 'Write only (check: most servers also read)' : 'Read and write';
+}
+export async function claudePack(m, token) {
+    const tools = await listTools(m, token);
+    const problems = [];
+    if ((m.oneLiner ?? '').length > 200)
+        problems.push(`oneLiner is ${m.oneLiner.length} characters; the limit is 200`);
+    if ((m.description ?? '').length > 2000)
+        problems.push(`description is ${m.description.length} characters; the limit is 2000`);
+    if (!m.icon)
+        problems.push('icon is missing; Claude asks for a direct .png/.svg URL when your favicon fails');
+    const pos = m.tests?.positive ?? [];
+    const useCases = (pos.length ? pos.slice(0, 4).map((p) => `${p.scenario}: "${p.prompt}"`) : (m.prompts ?? []).map((p) => `"${p}"`)).join('\n');
+    const tests = pos.length
+        ? pos.map((p, i) => `${i + 1}. "${p.prompt}" (${p.tools.join(', ')}): ${p.expected}`).join('\n')
+        : 'MISSING: add tests.positive to mcplane.json';
+    const md = `# Claude directory submission: ${m.title}
+
+Submit at claude.ai/directory/manage/new (any paid Claude plan). Ten steps; the draft autosaves.
+
+## 1. Connection
+- Server URL: ${m.server.url}
+- Authentication: ${m.server.auth === 'oauth' ? 'OAuth 2.0 + Dynamic Client Registration (Anthropic says DCR works best)' : 'No authentication (authless)'}
+
+## 2. Tools
+Every tool needs a title and explicit hints. Current tools: ${tools.map((t) => t.name).join(', ')}.
+
+## 3. Listing
+- Name: ${m.title}
+- Slug: ${m.name} (permanent after submission)
+- One-liner (${(m.oneLiner ?? '').length}/200): ${m.oneLiner ?? 'MISSING'}
+- Description (${(m.description ?? '').length}/2000):
+
+${m.description ?? 'MISSING'}
+
+- Author: ${m.author?.name ?? 'MISSING'}, ${m.author?.url ?? ''}
+- Icon: add a custom icon URL: ${m.icon ?? 'MISSING'} (the favicon fallback often fails)
+- Documentation: ${m.links?.docs ?? 'MISSING'}
+- Support: ${m.links?.support ?? 'MISSING'}
+- Privacy policy: ${m.links?.privacy ?? 'MISSING'}
+
+## 4. Use cases (at least three, each with an example prompt)
+${useCases || 'MISSING'}
+
+- Connection requirements: ${m.server.auth === 'oauth' ? 'An account on your service; say which plan.' : 'None. No account, sign-in or API key.'}
+- Read / write: ${readWrite(tools)}
+
+## 6. Authentication
+Match step 1. Partial auth is available if only some tools need sign-in.
+
+## 7. Data handling
+Answer API ownership, health data and sponsored content truthfully. Sponsored or promoted content is prohibited.
+
+## 8. Test & launch
+${m.server.auth === 'oauth' ? `Reviewer access: ${m.reviewerAccess ?? 'MISSING: a demo account with every step, link and credential needed'}\n` : 'No account or credentials needed.\n'}${tests}
+
+Tick "self-tested" only after running every tool.
+
+## 9. Compliance
+Seven statements you make yourself. One asks that tool descriptions contain no instructions about model behaviour: run \`mcplane preflight\` and explain any flagged line in Additional notes.
+
+## After
+"Passed review" is not the same as listed: check claude.ai/directory, and choose when to publish.
+When it's in: \`mcplane submitted claude-connectors\`
+`;
+    return { files: [{ path: 'claude-connectors.md', content: md }], problems, todo: [] };
+}
+export async function simplePack(m, store) {
+    const problems = [];
+    let md = '';
+    if (store === 'cursor') {
+        if (!m.repository)
+            problems.push('repository is missing; Cursor reads plugins from a public GitHub repo');
+        md = `# Cursor Marketplace: ${m.title}\n\nSubmit at cursor.com/marketplace/publish.\n\n- Repository: ${m.repository ?? 'MISSING'} (public, with a Cursor plugin manifest)\n- Name: ${m.title}\n- Description: ${m.oneLiner ?? m.description ?? 'MISSING'}\n- Website: ${m.links?.website ?? ''}\n\nEvery plugin is reviewed by hand. When it's in: \`mcplane submitted cursor\`. Review Times closes the report itself when your plugin appears in the marketplace.\n`;
+    }
+    else if (store === 'muse') {
+        md = `# Muse connectors: ${m.title}\n\nSubmit at muse.ai/platform, choosing "Existing MCP".\n\n- MCP server URL: ${m.server.url}\n- Auth: ${m.server.auth === 'oauth' ? 'OAuth (PKCE)' : 'None'}\n- Name: ${m.title}\n- Description: ${m.oneLiner ?? m.description ?? 'MISSING'}\n- Privacy: ${m.links?.privacy ?? 'MISSING'}\n\nMeta onboards in waves and gives no status yet. When it's in: \`mcplane submitted muse\`.\n`;
+    }
+    else {
+        throw new Error(`No pack for ${store} yet. Packs: chatgpt, claude-connectors, cursor, muse.`);
+    }
+    return { files: [{ path: `${store}.md`, content: md }], problems, todo: [] };
+}
+/** The long tail: directories that only take a web form. One sheet with every value to paste. */
+export function directoriesPack(m) {
+    const repo = m.repository?.replace(/\.git$/, '');
+    const desc = m.oneLiner ?? m.description ?? m.title;
+    const rows = [
+        ['MCP.Directory', 'https://mcp.directory/submit', 'Reads the official registry; claim the listing there, or submit a GitHub URL (reviewed within a day).'],
+        ['mcp.so', 'https://mcp.so/submit', 'Repo URL and name. Paid option skips review. No update mechanism: edit by hand.'],
+        ['MCP Market', 'https://mcpmarket.com/submit', 'GitHub URL, email, type. The free queue runs to weeks; paid lists within a day.'],
+        ['mcpservers.org', 'https://mcpservers.org/submit', 'Has a field for your Official MCP Registry name. Free takes about two weeks.'],
+        ['cursor.directory', 'https://cursor.directory', 'Submit from its MCP section.'],
+    ];
+    const md = `# Directory forms: ${m.title}
+
+Publish to the official MCP Registry first ("mcplane publish mcp-registry"): GitHub's registry, VS Code, PulseMCP and MCP.Directory read from it, so most of these become optional.
+
+Values to paste:
+- Name: ${m.title}
+- Description: ${desc}
+- Server URL: ${m.server.url}
+- Repository: ${repo ?? 'none'}
+- Website: ${m.links?.website ?? ''}
+- Icon: ${m.icon ?? ''}
+- Registry name: ${m.registry?.name ?? '(see "mcplane publish mcp-registry")'}
+
+| Directory | Where | Notes |
+|---|---|---|
+${rows.map((r) => `| ${r[0]} | ${r[1]} | ${r[2]} |`).join('\n')}
+
+Directories send little traffic on their own; the registry, the big stores and your own docs matter more. Do these once, and don't pay to skip a queue unless a launch date depends on it.
+`;
+    return { files: [{ path: 'directories.md', content: md }], problems: [], todo: [] };
+}
+export async function writePack(pack, dir = process.cwd()) {
+    await ensureLocalDir(dir);
+    const out = resolve(dir, '.mcplane/packs');
+    await mkdir(out, { recursive: true });
+    const written = [];
+    for (const f of pack.files) {
+        await writeFile(resolve(out, f.path), f.content);
+        written.push(`.mcplane/packs/${f.path}`);
+    }
+    return written;
+}
+export const _test = { thirdPerson, justify };

package/dist/preflight.js

@@ -0,0 +1,39 @@
+import { authChecks } from './checks/auth.js';
+import { listingChecks, repoChecks } from './checks/listing.js';
+import { serverChecks } from './checks/server.js';
+import { toolChecks } from './checks/tools.js';
+import { storesOf } from './manifest.js';
+/** Things no script can see, which have still cost real submissions. */
+function reminders(m, stores) {
+    const r = [];
+    if (m.server.auth === 'oauth') {
+        r.push('Give reviewers a demo account: email and password, no 2FA, SMS or email confirmation, seeded with data that matches every test case. Re-check the seed right before submitting.');
+        r.push('Sign in through your OAuth flow once as a brand-new user. A blank post-sign-in redirect stranded a ChatGPT reviewer between registration and consent.');
+    }
+    if (stores.includes('chatgpt')) {
+        r.push('ChatGPT needs a demo video recorded in developer mode that shows the tools your test cases use. Re-record it whenever tools change.');
+        r.push('After "Submit for Review" the ChatGPT portal shows nothing for about 20 seconds. Confirm the status on the plugins list, not the button.');
+        r.push('Tool-annotation justifications are cut at 200 characters without warning.');
+        r.push('ChatGPT allows one version in review at a time. To change a submission, Cancel Review and resubmit the same draft.');
+    }
+    if (stores.includes('claude-connectors') || stores.includes('claude-plugins')) {
+        if (stores.includes('claude-plugins'))
+            r.push('Run "claude plugin validate --strict" in the plugin repo; the portal validates every commit on the branch it tracks.');
+        r.push('Claude: "Passed review" is not the same as listed. Check claude.ai/directory for your listing after approval; with the new portal you choose when to publish.');
+    }
+    return r;
+}
+export async function preflight(m, opts = {}) {
+    const stores = opts.stores?.length ? opts.stores : storesOf(m);
+    const auth = m.server.auth ?? 'none';
+    const server = await serverChecks(m.server.url, auth, opts.token);
+    const [authC, listing, repo] = await Promise.all([
+        auth === 'oauth' ? authChecks(m.server.url, { register: opts.register }) : Promise.resolve([]),
+        listingChecks(m, server.tools, stores),
+        repoChecks(m, stores),
+    ]);
+    const all = [...server.checks, ...authC, ...toolChecks(server.tools), ...listing, ...repo];
+    // Keep checks that apply to every store or to one we're submitting to.
+    const checks = all.filter((c) => !c.stores?.length || c.stores.some((s) => stores.includes(s)));
+    return { checks, reminders: reminders(m, stores), stores };
+}

package/dist/publish.js

@@ -0,0 +1,271 @@
+/**
+ * Publishing where a store allows it. Dry run by default: it shows exactly
+ * what it will do, and only acts with --yes.
+ *
+ *   mcp-registry   writes server.json and runs mcp-publisher
+ *   grok           a complete pull request to xai-org/plugin-marketplace:
+ *                  entry pinned to your repo's HEAD, index regenerated and
+ *                  validated with xAI's own scripts (new listing or pin bump)
+ *   the rest       the exact entry or command, ready to use
+ */
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { repoHead } from './drift.js';
+const run = (cmd, args, cwd) => execFileSync(cmd, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+const has = (cmd) => {
+    try {
+        run('which', [cmd]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+function ghRepo(m) {
+    const g = m.repository?.match(/github\.com\/([^/]+)\/([^/#?]+?)(?:\.git)?$/);
+    return g ? { owner: g[1], repo: g[2] } : null;
+}
+/* ---------------- MCP Registry ---------------- */
+/** Shortens at a word boundary, so a limit never cuts a word in half. */
+const fit = (s, n) => (s.length <= n ? s : s.slice(0, n + 1).replace(/[\s,;:]+\S*$/, '').replace(/[\s,;:]+$/, ''));
+export function registryName(m) {
+    if (m.registry?.name)
+        return m.registry.name;
+    const gh = ghRepo(m);
+    if (gh)
+        return `io.github.${gh.owner}/${m.name}`;
+    const host = new URL(m.links?.website ?? m.server.url).hostname.replace(/^www\./, '');
+    return `${host.split('.').reverse().join('.')}/${m.name}`;
+}
+export function serverJson(m) {
+    return {
+        $schema: 'https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json',
+        name: registryName(m),
+        title: m.title,
+        description: fit(m.registry?.description ?? m.oneLiner ?? m.subtitle ?? m.title, 100),
+        ...(m.links?.website ? { websiteUrl: m.links.website } : {}),
+        ...(m.repository ? { repository: { url: m.repository.replace(/\.git$/, ''), source: 'github' } } : {}),
+        version: m.version ?? '1.0.0',
+        remotes: [{ type: 'streamable-http', url: m.server.url }],
+    };
+}
+/** Versions of this server already in the registry. Published versions can't change. */
+async function registryVersions(name) {
+    const r = await fetch(`https://registry.modelcontextprotocol.io/v0/servers?search=${encodeURIComponent(name)}`, { headers: { 'user-agent': 'mcplane' } }).catch(() => null);
+    const data = r?.ok ? (await r.json().catch(() => null)) : null;
+    return (data?.servers ?? []).filter((x) => x.server.name === name).map((x) => x.server.version);
+}
+/** 1.2.0 → 1.2.0-1, 1.2.0-1 → 1.2.0-2: the registry's way to change metadata without a new release. */
+const nextPrerelease = (v) => (/-(\d+)$/.test(v) ? v.replace(/-(\d+)$/, (_, n) => `-${Number(n) + 1}`) : `${v}-1`);
+const REGISTRY_READERS = 'GitHub’s MCP Registry (and VS Code), PulseMCP and MCP.Directory read from the official registry, so they pick this up on their own.';
+async function publishRegistry(m, yes, dir) {
+    const json = serverJson(m);
+    const file = m.registry?.file ?? 'server.json';
+    const lines = [];
+    const existing = await registryVersions(json.name);
+    if (existing.includes(json.version)) {
+        return {
+            store: 'mcp-registry',
+            done: false,
+            lines: [`${json.name} v${json.version} is already in the registry, and published versions can't change. Bump "version" in mcplane.json, or for a listing-only change use a prerelease such as ${nextPrerelease(json.version)}.`],
+        };
+    }
+    const long = (m.registry?.description ?? m.oneLiner ?? '').length > 100;
+    if (long)
+        lines.push('Description trimmed to 100 characters, the registry’s limit. Set registry.description in mcplane.json to choose the words.');
+    const ns = json.name.split('/')[0];
+    const auth = ns.startsWith('io.github.') ? `mcp-publisher login github` : `mcp-publisher login dns --domain ${ns.split('.').reverse().join('.')} --private-key <key>  (after adding the TXT record it prints)`;
+    if (!yes) {
+        return { store: 'mcp-registry', done: false, lines: [...lines, `Would write ${file}:`, JSON.stringify(json, null, 2), '', 'Then: mcp-publisher validate && mcp-publisher publish', `Log in first if needed: ${auth}`, existing.length ? `Already published: ${existing.join(', ')}.` : 'First version of this name.', REGISTRY_READERS, 'Run again with --yes to do it.'] };
+    }
+    writeFileSync(resolve(dir, file), JSON.stringify(json, null, 2) + '\n');
+    if (!has('mcp-publisher'))
+        return { store: 'mcp-registry', done: false, lines: [...lines, `Wrote ${file}. Install mcp-publisher (brew install mcp-publisher), then: ${auth} && mcp-publisher publish`] };
+    // In GitHub Actions, sign in without secrets (io.github.* names need "permissions: id-token: write"); DNS names use MCP_PRIVATE_KEY.
+    if (process.env.GITHUB_ACTIONS === 'true') {
+        try {
+            if (ns.startsWith('io.github.') && process.env.ACTIONS_ID_TOKEN_REQUEST_URL)
+                run('mcp-publisher', ['login', 'github-oidc'], dir);
+            else if (!ns.startsWith('io.github.') && process.env.MCP_PRIVATE_KEY)
+                run('mcp-publisher', ['login', 'dns', '--domain', ns.split('.').reverse().join('.'), '--private-key', process.env.MCP_PRIVATE_KEY], dir);
+        }
+        catch (e) {
+            return { store: 'mcp-registry', done: false, lines: [...lines, 'Signing in to the registry from CI failed:', String(e.stderr ?? e.message).trim()] };
+        }
+    }
+    try {
+        run('mcp-publisher', ['validate', file], dir);
+        const out = run('mcp-publisher', ['publish', file], dir);
+        return { store: 'mcp-registry', done: true, lines: [...lines, `Wrote ${file} and published ${json.name} v${json.version}.`, out, REGISTRY_READERS], url: `https://registry.modelcontextprotocol.io/v0/servers?search=${encodeURIComponent(json.name)}` };
+    }
+    catch (e) {
+        const err = String(e.stderr ?? e.message);
+        return { store: 'mcp-registry', done: false, lines: [...lines, `Wrote ${file}, but publishing failed:`, err.trim(), /auth|login|token|401|403/i.test(err) ? `Log in: ${auth}` : ''] };
+    }
+}
+/* ---------------- Grok (xai-org/plugin-marketplace) ---------------- */
+const GROK = 'xai-org/plugin-marketplace';
+function grokEntry(m, sha) {
+    const gh = ghRepo(m);
+    const host = new URL(m.links?.website ?? m.server.url).hostname.replace(/^www\./, '');
+    return {
+        name: m.name,
+        description: m.grok?.description ?? m.oneLiner ?? m.description ?? m.title,
+        category: m.grok?.category ?? 'development',
+        source: { source: 'url', url: `https://github.com/${gh.owner}/${gh.repo}.git`, sha },
+        ...(m.links?.website ? { homepage: m.links.website } : {}),
+        keywords: m.grok?.keywords ?? [m.name, m.title.toLowerCase()],
+        domains: m.grok?.domains ?? [host],
+    };
+}
+/** Adds or re-pins our entry without reformatting the rest of the file. */
+function editMarketplace(text, entry) {
+    const data = JSON.parse(text);
+    const existing = data.plugins.find((p) => p.name === entry.name);
+    if (existing) {
+        const old = existing.source?.sha;
+        if (!old || old === entry.source.sha)
+            return { text, mode: 'same' };
+        return { text: text.replace(old, entry.source.sha), mode: 'bump' };
+    }
+    const block = JSON.stringify(entry, null, 2)
+        .split('\n')
+        .map((l) => `    ${l}`)
+        .join('\n');
+    const end = text.lastIndexOf('}\n  ]');
+    if (end < 0)
+        throw new Error('Couldn’t find the end of the plugins list in marketplace.json.');
+    return { text: `${text.slice(0, end + 1)},\n${block}${text.slice(end + 1)}`, mode: 'add' };
+}
+async function publishGrok(m, yes) {
+    const gh = ghRepo(m);
+    if (!gh)
+        return { store: 'grok', done: false, lines: ['Grok plugins come from a public GitHub repository. Set "repository" in mcplane.json.'] };
+    const sha = await repoHead(m.repository);
+    if (!sha)
+        return { store: 'grok', done: false, lines: [`Couldn't read the latest commit of ${m.repository}. Is it public?`] };
+    const entry = grokEntry(m, sha);
+    if (!yes) {
+        return {
+            store: 'grok',
+            done: false,
+            lines: [
+                `Would open a pull request to ${GROK} with this entry (pinned to ${sha.slice(0, 7)}), or bump the pin if ${m.name} is already listed:`,
+                JSON.stringify(entry, null, 2),
+                '',
+                'Steps: fork, branch, edit .grok-plugin/marketplace.json, run scripts/generate-plugin-index.py and scripts/validate-catalog.py (xAI’s CI checks), push, open the PR.',
+                'Needs: gh (logged in), git, python3. Run again with --yes to do it.',
+            ],
+        };
+    }
+    for (const tool of ['gh', 'git', 'python3'])
+        if (!has(tool))
+            return { store: 'grok', done: false, lines: [`${tool} is required for this. Install it and try again.`] };
+    const me = run('gh', ['api', 'user', '--jq', '.login']);
+    try {
+        run('gh', ['repo', 'fork', GROK, '--clone=false']);
+    }
+    catch {
+        // Already forked.
+    }
+    const dir = mkdtempSync(join(tmpdir(), 'mcplane-grok-'));
+    run('git', ['clone', '--depth', '50', `https://github.com/${GROK}.git`, dir]);
+    const branch = `mcplane/${m.name}-${sha.slice(0, 7)}`;
+    run('git', ['checkout', '-b', branch], dir);
+    const file = join(dir, '.grok-plugin/marketplace.json');
+    const edit = editMarketplace(readFileSync(file, 'utf8'), entry);
+    if (edit.mode === 'same')
+        return { store: 'grok', done: true, lines: [`${m.name} is already listed and pinned to ${sha.slice(0, 7)}. Nothing to do.`] };
+    writeFileSync(file, edit.text);
+    run('python3', ['scripts/generate-plugin-index.py'], dir);
+    run('python3', ['scripts/validate-catalog.py'], dir);
+    run('python3', ['scripts/generate-plugin-index.py', '--check'], dir);
+    const title = edit.mode === 'add' ? `Add ${m.name} plugin` : `Bump ${m.name} to ${sha.slice(0, 7)}`;
+    run('git', ['add', '.grok-plugin'], dir);
+    run('git', ['-c', 'user.name=mcplane', '-c', `user.email=${me}@users.noreply.github.com`, 'commit', '-m', title], dir);
+    run('git', ['remote', 'add', 'fork', `https://github.com/${me}/plugin-marketplace.git`], dir);
+    run('git', ['push', 'fork', branch], dir);
+    const body = [
+        edit.mode === 'add' ? `Adds **${m.title}**: ${entry.description}` : `Re-pins **${m.name}** to ${sha}.`,
+        '',
+        `- Source: https://github.com/${gh.owner}/${gh.repo} at \`${sha}\``,
+        ...(m.links?.website ? [`- Homepage: ${m.links.website}`] : []),
+        '- `validate-catalog.py` and `generate-plugin-index.py --check` pass locally.',
+    ].join('\n');
+    const url = run('gh', ['pr', 'create', '--repo', GROK, '--head', `${me}:${branch}`, '--title', title, '--body', body]);
+    return { store: 'grok', done: true, lines: [`Opened ${url}`], url };
+}
+/* ---------------- Prepared, not automated ---------------- */
+function prepared(m, store) {
+    const gh = ghRepo(m);
+    const desc = m.oneLiner ?? m.subtitle ?? m.title;
+    if (store === 'awesome-mcp-servers') {
+        const link = gh ? `[${gh.owner}/${gh.repo}](https://github.com/${gh.owner}/${gh.repo})` : `[${m.title}](${m.links?.website ?? m.server.url})`;
+        return {
+            store,
+            done: false,
+            lines: [
+                'Add this line to the right category in punkpeye/awesome-mcp-servers README.md (☁️ marks a hosted server), then open a pull request:',
+                `- ${link} ☁️ - ${desc}`,
+                'Keep categories alphabetical, follow their legend and include your Glama score badge ("mcplane publish glama"); PRs without it are the ones that wait.',
+            ],
+        };
+    }
+    if (store === 'smithery') {
+        return { store, done: false, lines: [`smithery mcp publish ${m.server.url} -n @<your-org>/${m.name}`, 'Or at https://smithery.ai/new. If Smithery’s scan can’t get past your sign-in, serve /.well-known/mcp/server-card.json describing your tools.'] };
+    }
+    if (store === 'glama') {
+        const owner = gh?.owner ?? '<your-github-user>';
+        return {
+            store,
+            done: false,
+            lines: [
+                `Add ${gh ? `https://github.com/${gh.owner}/${gh.repo}` : 'your GitHub repo'} at https://glama.ai/mcp/servers ("Add MCP Server"). Glama runs its own checks (license, security, health) and scores the server.`,
+                'To claim the listing, commit glama.json at the repo root:',
+                JSON.stringify({ $schema: 'https://glama.ai/mcp/schemas/server.json', maintainers: [owner] }, null, 2),
+                'awesome-mcp-servers asks for the Glama score badge on each entry, so do this first.',
+            ],
+        };
+    }
+    if (store === 'cline') {
+        if (!gh)
+            return { store, done: false, lines: ['Cline’s marketplace lists GitHub repositories. Set "repository" in mcplane.json.'] };
+        const q = new URLSearchParams({ template: 'mcp-server-submission.yml', title: `Add ${m.title}`, 'repo-url': `https://github.com/${gh.owner}/${gh.repo}`, 'additional-info': `${desc}\n\nRemote server: ${m.server.url}` });
+        return {
+            store,
+            done: false,
+            lines: [
+                `Open the prefilled issue: https://github.com/cline/mcp-marketplace/issues/new?${q}`,
+                'Attach a 400×400 PNG logo, and tick the testing boxes only after Cline has set the server up from your README (or llms-install.md) alone. Review takes a couple of days.',
+            ],
+        };
+    }
+    if (store === 'lobehub') {
+        return {
+            store,
+            done: false,
+            lines: [
+                `npx @lobehub/market-cli plugin publish ${gh ? `https://github.com/${gh.owner}/${gh.repo}` : '<your GitHub repo>'}`,
+                'It signs in through your browser, so it can’t run in CI. Re-run "plugin update" after changes; a new version number creates a new release.',
+            ],
+        };
+    }
+    if (store === 'docker') {
+        return {
+            store,
+            done: false,
+            lines: ['In a fork of docker/mcp-registry run "task remote-wizard" (remote servers) or "task wizard" (images) and open the pull request it prepares. Entries pin a commit, so each update is a new PR. Live within 24 hours of approval.'],
+        };
+    }
+    return { store, done: false, lines: [`${store} is submitted through a form. Run "mcplane pack ${store}" for everything it asks.`] };
+}
+export async function publish(m, store, opts = {}) {
+    if (store === 'mcp-registry')
+        return publishRegistry(m, !!opts.yes, opts.dir ?? process.cwd());
+    if (store === 'grok')
+        return publishGrok(m, !!opts.yes);
+    return prepared(m, store);
+}
+export const _test = { editMarketplace, grokEntry, nextPrerelease };

package/dist/report.js

@@ -0,0 +1,31 @@
+import { STORE_NAMES } from './types.js';
+const tty = process.stdout.isTTY;
+const c = (code, s) => (tty ? `\x1b[${code}m${s}\x1b[0m` : s);
+const MARK = { pass: c('32', '✓'), warn: c('33', '!'), fail: c('31', '✗'), skip: c('90', '-') };
+export function printPreflight(r, opts = {}) {
+    const fails = r.checks.filter((x) => x.level === 'fail');
+    const warns = r.checks.filter((x) => x.level === 'warn');
+    console.log(c('1', `Preflight for ${r.stores.map((s) => STORE_NAMES[s]).join(', ')}`));
+    console.log('');
+    for (const x of r.checks) {
+        if (x.level === 'pass' && !opts.verbose)
+            continue;
+        const where = x.stores?.length ? c('90', ` [${x.stores.map((s) => STORE_NAMES[s]).join(', ')}]`) : '';
+        console.log(`${MARK[x.level]} ${x.title}${where}`);
+        if (x.detail)
+            console.log(c('90', `    ${x.detail}`));
+        if (x.fix && x.level !== 'pass')
+            console.log(`    ${x.fix}`);
+    }
+    const passed = r.checks.length - fails.length - warns.length;
+    if (!opts.verbose && passed)
+        console.log(c('32', `✓ ${passed} checks passed`) + c('90', ' (--verbose to list them)'));
+    if (r.reminders.length) {
+        console.log('');
+        console.log(c('1', 'Check these yourself'));
+        for (const t of r.reminders)
+            console.log(`  • ${t}`);
+    }
+    console.log('');
+    console.log(fails.length ? c('31', `${fails.length} blocking, ${warns.length} to review.`) : warns.length ? c('33', `No blockers, ${warns.length} to review.`) : c('32', 'Ready to submit.'));
+}