mcplane 0.2.0 → 0.3.1

package/README.md

@@ -7,6 +7,8 @@ npx mcplane init --url https://mcp.example.com/mcp
 npx mcplane preflight
 ```
 
+No terminal handy? Paste your URL at [reviewtimes.fyi/check](https://reviewtimes.fyi/check).
+
 ```
 ✗ DNS does not advertise Encrypted ClientHello [ChatGPT]
     example.com has ech= in its HTTPS record
@@ -220,6 +222,17 @@ mcp                           Run as an MCP server over stdio
 
 Servers behind sign-in: pass `--token` or set `MCPLANE_TOKEN` so tool checks can run.
 
+## Use the checks in your own code
+
+`mcplane/core` runs anywhere with `fetch` (Workers, Deno, Bun, Node):
+
+```ts
+import { draftManifest, preflight } from 'mcplane/core';
+const report = await preflight(await draftManifest('https://mcp.example.com/mcp'));
+```
+
+It's what powers [reviewtimes.fyi/check](https://reviewtimes.fyi/check). The TLS 1.2 handshake needs a raw socket, so only the CLI runs that one.
+
 ## mcplane.json
 
 One file describes your server and its listings. [`schema.json`](schema.json) gives editors completion and validation; `mcplane init` adds the `$schema` line. [`examples/mcplane.json`](examples/mcplane.json) is a complete one, from [Review Times](https://reviewtimes.fyi)' own ChatGPT and Claude submissions.

package/dist/checks/auth.d.ts

@@ -0,0 +1,9 @@
+/**
+ * OAuth checks, from Stacktree's ChatGPT rounds. Read-only by default:
+ * registering a client writes to your authorization server, so that only
+ * happens with --register.
+ */
+import type { Check } from '../types.js';
+export declare function authChecks(url: string, opts?: {
+    register?: boolean;
+}): Promise<Check[]>;

package/dist/checks/listing.d.ts

@@ -0,0 +1,4 @@
+import type { Check, Manifest, StoreId, Tool } from '../types.js';
+export declare function listingChecks(m: Manifest, tools: Tool[], stores: StoreId[]): Promise<Check[]>;
+/** Rules for plugin repositories (Claude plugins, Cursor, Grok). */
+export declare function repoChecks(m: Manifest, stores: StoreId[]): Promise<Check[]>;

package/dist/checks/server.d.ts

@@ -0,0 +1,8 @@
+import type { Check, Tool } from '../types.js';
+/** Connects the way a store's scanner does and returns the tool list for the other checks. */
+/** A check that needs a raw socket, which only some runtimes have. Node passes the TLS 1.2 check in. */
+export type SocketCheck = (url: string) => Promise<Check>;
+export declare function serverChecks(url: string, auth: 'none' | 'oauth', token?: string, extra?: SocketCheck[]): Promise<{
+    checks: Check[];
+    tools: Tool[];
+}>;

package/dist/checks/server.js

@@ -1,8 +1,6 @@
-import { connect } from 'node:tls';
 import { McpClient } from '../mcp-client.js';
 const BROWSER_UA = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0 Safari/537.36';
-/** Connects the way a store's scanner does and returns the tool list for the other checks. */
-export async function serverChecks(url, auth, token) {
+export async function serverChecks(url, auth, token, extra = []) {
     const checks = [];
     const bearer = token ? { authorization: `Bearer ${token}` } : {};
     const client = new McpClient(url, bearer);
@@ -128,26 +126,11 @@ export async function serverChecks(url, auth, token) {
             fix: 'A firewall or bot rule is returning 403 to non-browser clients. Store scanners and reviewers are automated; allow them on the MCP path.',
         });
     }
-    checks.push(await tls12Check(url));
+    for (const c of extra)
+        checks.push(await c(url));
     checks.push(await echCheck(url));
     return { checks, tools };
 }
-/** Some review networks only speak TLS 1.2. */
-function tls12Check(url) {
-    const host = new URL(url).hostname;
-    return new Promise((resolve) => {
-        const sock = connect({ host, port: 443, servername: host, maxVersion: 'TLSv1.2', timeout: 8000 }, () => {
-            sock.end();
-            resolve({ id: 'server.tls12', level: 'pass', title: 'A TLS 1.2 client can connect' });
-        });
-        const bad = (why) => resolve({ id: 'server.tls12', level: 'warn', title: 'A TLS 1.2 client can connect', detail: why, fix: 'Allow TLS 1.2; some corporate and review proxies cannot do TLS 1.3.' });
-        sock.on('error', (e) => bad(e.message));
-        sock.on('timeout', () => {
-            sock.destroy();
-            bad('timed out');
-        });
-    });
-}
 /** Encrypted ClientHello in DNS makes TLS-inspecting proxies reset the connection. */
 async function echCheck(url) {
     const host = new URL(url).hostname;

package/dist/checks/tls.d.ts

@@ -0,0 +1,3 @@
+import type { Check } from '../types.js';
+/** Some review networks only speak TLS 1.2. */
+export declare function tls12Check(url: string): Promise<Check>;

package/dist/checks/tls.js

@@ -0,0 +1,17 @@
+import { connect } from 'node:tls';
+/** Some review networks only speak TLS 1.2. */
+export function tls12Check(url) {
+    const host = new URL(url).hostname;
+    return new Promise((resolve) => {
+        const sock = connect({ host, port: 443, servername: host, maxVersion: 'TLSv1.2', timeout: 8000 }, () => {
+            sock.end();
+            resolve({ id: 'server.tls12', level: 'pass', title: 'A TLS 1.2 client can connect' });
+        });
+        const bad = (why) => resolve({ id: 'server.tls12', level: 'warn', title: 'A TLS 1.2 client can connect', detail: why, fix: 'Allow TLS 1.2; some corporate and review proxies cannot do TLS 1.3.' });
+        sock.on('error', (e) => bad(e.message));
+        sock.on('timeout', () => {
+            sock.destroy();
+            bad('timed out');
+        });
+    });
+}

package/dist/checks/tools.d.ts

@@ -0,0 +1,2 @@
+import type { Check, Tool } from '../types.js';
+export declare function toolChecks(tools: Tool[]): Check[];

package/dist/checks/tools.js

@@ -12,17 +12,17 @@ const INSTRUCTION = [
     /\b(call|use) (this|it) only\b/i,
 ];
 /** Plan and pricing copy. OpenAI prohibits in-app upsells, "including freemium upsells". */
-const UPSELL = /\b(upgrade|pro plan|premium|paid plan|pricing|subscribe|subscription|free trial|unlock)\b/i;
+// Plan and tier language only: product prices ("live pricing", "premium cars") are not upsells.
+const UPSELL = /\b(upgrade (to|your|now)|pro plan|premium (plan|tier|account|subscription|version)|paid (plan|tier|account)|free trial|subscribe (to|now)|unlock (more|premium|pro|unlimited|all))\b/i;
 /** Inputs that suggest a write authorised only by a secret passed through the chat. */
 const BEARER_INPUT = /^(token|edit_token|update_token|secret|access_key|api_key|password)$/i;
 export function toolChecks(tools) {
     if (!tools.length)
         return [];
     const checks = [];
-    const names = new Set(tools.map((t) => t.name));
     const noTitle = tools.filter((t) => !t.title && !t.annotations?.title);
     checks.push(noTitle.length
-        ? { id: 'tools.title', level: 'fail', title: 'Every tool has a human-readable title', detail: noTitle.map((t) => t.name).join(', '), fix: 'Add "title" (or annotations.title) to each tool. Anthropic rejects connectors without them.', stores: ['claude-connectors', 'claude-plugins'] }
+        ? { id: 'tools.title', level: 'warn', title: 'Every tool has a human-readable title', detail: noTitle.map((t) => t.name).join(', '), fix: 'Add "title" (or annotations.title) to each tool. Clients show the raw name without one, and Anthropic’s reviewers ask for them on new submissions.', stores: ['claude-connectors', 'claude-plugins'] }
         : { id: 'tools.title', level: 'pass', title: 'Every tool has a human-readable title' });
     const missing = tools.flatMap((t) => HINTS.filter((h) => typeof t.annotations?.[h] !== 'boolean').map((h) => `${t.name}.${h}`));
     checks.push(missing.length
@@ -46,8 +46,8 @@ export function toolChecks(tools) {
     const instructing = tools.flatMap((t) => {
         const text = `${t.description ?? ''}`;
         const hits = INSTRUCTION.filter((re) => re.test(text)).map((re) => text.match(re)[0]);
-        const others = [...names].filter((n) => n !== t.name && text.includes(n));
-        return hits.length || others.length ? [`${t.name}: ${[...hits.map((h) => `"${h}"`), ...others.map((n) => `mentions ${n}`)].join(', ')}`] : [];
+        // Naming a sibling tool ("call get_session first") is common in approved listings, so only explicit instructions count.
+        return hits.length ? [`${t.name}: ${hits.map((h) => `"${h}"`).join(', ')}`] : [];
     });
     checks.push(instructing.length
         ? {

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/core.d.ts

@@ -0,0 +1,18 @@
+import type { SocketCheck } from './checks/server.js';
+import type { Check, Manifest, StoreId } from './types.js';
+export interface PreflightResult {
+    checks: Check[];
+    reminders: string[];
+    stores: StoreId[];
+}
+/** Runtime-neutral: fetch only. Node adds socket checks (TLS 1.2) through extraChecks; see preflight-node. */
+export declare function preflight(m: Manifest, opts?: {
+    stores?: StoreId[];
+    register?: boolean;
+    token?: string;
+    extraChecks?: SocketCheck[];
+}): Promise<PreflightResult>;
+export { draftManifest, storesOf, SCHEMA_URL } from './draft.js';
+export { toolChecks } from './checks/tools.js';
+export { STORE_NAMES } from './types.js';
+export type { Check, Level, Manifest, StoreId, Tool } from './types.js';

package/dist/core.js

@@ -0,0 +1,52 @@
+/**
+ * mcplane's checks for any runtime with fetch (Workers, Deno, browsers' servers).
+ * Import from "mcplane/core".
+ */
+import { authChecks } from './checks/auth.js';
+import { listingChecks, repoChecks } from './checks/listing.js';
+import { serverChecks } from './checks/server.js';
+import { toolChecks } from './checks/tools.js';
+import { storesOf } from './draft.js';
+/** Things no script can see, which have still cost real submissions. */
+function reminders(m, stores) {
+    const r = [];
+    if (m.server.auth === 'oauth') {
+        r.push('Give reviewers a demo account a stranger can use: email and password (not your Google or SSO login), email already confirmed, no 2FA or SMS, seeded with data for every test case. Re-check the seed right before submitting.');
+        r.push('Sign in through your OAuth flow once as a brand-new user. A blank post-sign-in redirect stranded a ChatGPT reviewer between registration and consent.');
+    }
+    if (stores.some((s) => s === 'chatgpt' || s === 'claude-connectors')) {
+        r.push('If a tool writes somewhere public (posts, sends, publishes), give reviewers a safe target: a sandbox account or a "playground" option that validates and then discards. Reviewers test writes; they shouldn’t post to a real timeline.');
+    }
+    if (stores.includes('chatgpt')) {
+        r.push('ChatGPT needs a demo video recorded in developer mode that shows the tools your test cases use. Re-record it whenever tools change.');
+        r.push('After "Submit for Review" the ChatGPT portal shows nothing for about 20 seconds. Confirm the status on the plugins list, not the button.');
+        r.push('Tool-annotation justifications are cut at 200 characters without warning.');
+        r.push('ChatGPT allows one version in review at a time. To change a submission, Cancel Review and resubmit the same draft.');
+    }
+    if (stores.includes('claude-connectors') || stores.includes('claude-plugins')) {
+        if (stores.includes('claude-connectors'))
+            r.push('Claude connectors are submitted from an organisation’s admin settings (claude.ai/directory/manage), so you need admin rights in a paid org. The tool list is synced from your server when you submit; it is not an editable field.');
+        if (stores.includes('claude-plugins'))
+            r.push('Run "claude plugin validate --strict" in the plugin repo; the portal validates every commit on the branch it tracks.');
+        r.push('Claude: "Passed review" is not the same as listed. Check claude.ai/directory for your listing after approval; with the new portal you choose when to publish.');
+    }
+    return r;
+}
+/** Runtime-neutral: fetch only. Node adds socket checks (TLS 1.2) through extraChecks; see preflight-node. */
+export async function preflight(m, opts = {}) {
+    const stores = opts.stores?.length ? opts.stores : storesOf(m);
+    const auth = m.server.auth ?? 'none';
+    const server = await serverChecks(m.server.url, auth, opts.token, opts.extraChecks);
+    const [authC, listing, repo] = await Promise.all([
+        auth === 'oauth' ? authChecks(m.server.url, { register: opts.register }) : Promise.resolve([]),
+        listingChecks(m, server.tools, stores),
+        repoChecks(m, stores),
+    ]);
+    const all = [...server.checks, ...authC, ...toolChecks(server.tools), ...listing, ...repo];
+    // Keep checks that apply to every store or to one we're submitting to.
+    const checks = all.filter((c) => !c.stores?.length || c.stores.some((s) => stores.includes(s)));
+    return { checks, reminders: reminders(m, stores), stores };
+}
+export { draftManifest, storesOf, SCHEMA_URL } from './draft.js';
+export { toolChecks } from './checks/tools.js';
+export { STORE_NAMES } from './types.js';

package/dist/draft.d.ts

@@ -0,0 +1,5 @@
+import { type Manifest, type StoreId } from './types.js';
+export declare const SCHEMA_URL = "https://unpkg.com/mcplane/schema.json";
+export declare function storesOf(m: Manifest): StoreId[];
+/** A starting manifest from what the live server and its domain reveal. */
+export declare function draftManifest(url: string): Promise<Manifest>;

package/dist/draft.js

@@ -0,0 +1,55 @@
+/** Runtime-neutral pieces of the manifest: fetch only, no filesystem. */
+import { McpClient } from './mcp-client.js';
+import { STORE_NAMES } from './types.js';
+export const SCHEMA_URL = 'https://unpkg.com/mcplane/schema.json';
+export function storesOf(m) {
+    return m.stores?.length ? m.stores : Object.keys(STORE_NAMES);
+}
+/** A starting manifest from what the live server and its domain reveal. */
+export async function draftManifest(url) {
+    const client = new McpClient(url);
+    const init = await client.initialize().catch(() => null);
+    const auth = init?.status === 401 ? 'oauth' : 'none';
+    const info = init?.body?.result?.serverInfo ?? {};
+    const host = new URL(url).hostname;
+    const labels = host.split('.');
+    // api.example.com and mcp.example.com usually keep their pages on example.com.
+    const origins = [`https://${host}`, ...(labels.length > 2 ? [`https://${labels.slice(1).join('.')}`] : [])];
+    const origin = origins[origins.length - 1];
+    const found = async (p) => {
+        for (const o of origins) {
+            const r = await fetch(o + p, { method: 'GET', redirect: 'follow' }).catch(() => null);
+            if (r?.ok && !(r.headers.get('content-type') ?? '').includes('json'))
+                return o + p;
+        }
+        return undefined;
+    };
+    const first = async (...paths) => {
+        for (const p of paths) {
+            const hit = await found(p);
+            if (hit)
+                return hit;
+        }
+        return undefined;
+    };
+    const [privacy, support, terms, docs, icon] = await Promise.all([
+        first('/privacy', '/privacy-policy', '/legal/privacy'),
+        first('/support', '/contact', '/help'),
+        first('/terms', '/terms-of-service', '/legal/terms'),
+        first('/llms.txt', '/docs'),
+        first('/icon-512.png', '/icon.png', '/apple-touch-icon.png'),
+    ]);
+    return {
+        $schema: SCHEMA_URL,
+        name: String(info.name ?? new URL(url).hostname.split('.')[0]),
+        title: String(info.title ?? info.name ?? ''),
+        subtitle: '',
+        oneLiner: '',
+        description: '',
+        server: { url, auth },
+        author: { name: '', url: origin },
+        links: { website: origin, support, privacy, terms, docs },
+        icon,
+        stores: ['mcp-registry', 'chatgpt', 'claude-connectors', 'cursor', 'muse'],
+    };
+}

package/dist/drift.d.ts

@@ -0,0 +1,57 @@
+import { type Manifest, type StoreId, type Tool } from './types.js';
+interface ToolShape {
+    name: string;
+    title?: string;
+    description?: string;
+    hints: {
+        readOnly?: boolean;
+        destructive?: boolean;
+        openWorld?: boolean;
+    };
+    input: string;
+    output: string;
+}
+export interface Snapshot {
+    store: StoreId;
+    takenOn: string;
+    version?: string;
+    state: 'submitted' | 'live';
+    tools: ToolShape[];
+    listing: Record<string, string | undefined>;
+    repoSha?: string;
+}
+export interface DriftItem {
+    store: StoreId;
+    level: 'action' | 'info';
+    what: string;
+    todo: string;
+}
+export declare function liveTools(m: Manifest, token?: string): Promise<Tool[]>;
+/** HEAD of the plugin repository on GitHub, when there is one. */
+export declare function repoHead(repository?: string): Promise<string | undefined>;
+export declare function takeSnapshot(m: Manifest, store: StoreId, opts: {
+    version?: string;
+    state: Snapshot['state'];
+    token?: string;
+}, dir?: string): Promise<Snapshot>;
+export declare function markLive(store: StoreId, dir?: string): Promise<void>;
+/** What changed between a snapshot and now, as plain descriptions. */
+export declare function diffTools(before: ToolShape[], now: ToolShape[]): {
+    added: string[];
+    removed: string[];
+    changed: {
+        tool: string;
+        fields: string[];
+    }[];
+};
+export declare function drift(m: Manifest, stores: StoreId[], opts?: {
+    token?: string;
+}, dir?: string): Promise<{
+    items: DriftItem[];
+    missing: StoreId[];
+}>;
+export declare function printDrift(r: {
+    items: DriftItem[];
+    missing: StoreId[];
+}): void;
+export {};

package/dist/extras.d.ts

@@ -0,0 +1,13 @@
+import type { Manifest } from './types.js';
+export declare const DEFAULT_LANES: Record<string, string[]>;
+export declare function lanes(m: Manifest): Record<string, string[]>;
+/**
+ * Runs a lane step by step. A step that fails stops the lane unless it starts
+ * with "?" (optional). "handoff:" steps are what only a person can do: policy
+ * statements, the final submit. They're collected and shown at the end.
+ */
+export declare function runLane(name: string, steps: string[], passthrough: string[]): number;
+export declare function tryLinks(m: Manifest): {
+    client: string;
+    how: string;
+}[];

package/dist/fleet.d.ts

@@ -0,0 +1,40 @@
+import type { Manifest, StoreId } from './types.js';
+export interface Project {
+    dir: string;
+    path: string;
+    manifest?: Manifest;
+    error?: string;
+}
+/** Folders under root that hold an mcplane.json, depth-first, a few levels down. */
+export declare function findProjects(root?: string, depth?: number): Promise<Project[]>;
+export interface FleetRow {
+    project: string;
+    name?: string;
+    url?: string;
+    blocking?: number;
+    toReview?: number;
+    driftActions?: {
+        store: StoreId;
+        what: string;
+    }[];
+    noSnapshot?: StoreId[];
+    waiting: {
+        store: StoreId;
+        since: string;
+    }[];
+    live: StoreId[];
+    listedOn?: StoreId[];
+    listingIssues?: {
+        store: StoreId;
+        issue: string;
+    }[];
+    error?: string;
+}
+/** Preflight, drift, listings and submissions for every project under root. Checks run four projects at a time. */
+export declare function fleet(root?: string, opts?: {
+    checks?: boolean;
+    token?: string;
+}): Promise<FleetRow[]>;
+export declare function printFleet(rows: FleetRow[]): void;
+/** Runs one mcplane command in every project, one after another. */
+export declare function fleetRun(root: string, args: string[]): Promise<number>;

package/dist/listings.d.ts

@@ -0,0 +1,13 @@
+import { type Manifest, type StoreId } from './types.js';
+export interface Listing {
+    store: StoreId;
+    state: 'listed' | 'missing' | 'unknown';
+    url?: string;
+    /** Differences between the live record and your server or mcplane.json. */
+    issues: string[];
+    note?: string;
+}
+export declare function printListings(rows: Listing[]): void;
+export declare function listings(m: Manifest, stores: StoreId[], opts?: {
+    token?: string;
+}): Promise<Listing[]>;

package/dist/manifest.d.ts

@@ -0,0 +1,10 @@
+import { type Manifest } from './types.js';
+export { draftManifest, storesOf } from './draft.js';
+export declare const MANIFEST_FILE = "mcplane.json";
+export { SCHEMA_URL } from './draft.js';
+export declare function loadManifest(dir?: string): Promise<Manifest>;
+/**
+ * Creates .mcplane with its own .gitignore: snapshots are committed (CI reads
+ * them for drift), while submissions (private Review Times tokens) and packs stay local.
+ */
+export declare function ensureLocalDir(dir?: string): Promise<string>;

package/dist/manifest.js

@@ -1,9 +1,9 @@
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
-import { McpClient } from './mcp-client.js';
 import { STORE_NAMES } from './types.js';
+export { draftManifest, storesOf } from './draft.js';
 export const MANIFEST_FILE = 'mcplane.json';
-export const SCHEMA_URL = 'https://unpkg.com/mcplane/schema.json';
+export { SCHEMA_URL } from './draft.js';
 export async function loadManifest(dir = process.cwd()) {
     const path = resolve(dir, MANIFEST_FILE);
     let raw;
@@ -44,54 +44,3 @@ export async function ensureLocalDir(dir = process.cwd()) {
     await writeFile(resolve(d, '.gitignore'), 'submissions.json\npacks/\n', { flag: 'wx' }).catch(() => null);
     return d;
 }
-export function storesOf(m) {
-    return m.stores?.length ? m.stores : Object.keys(STORE_NAMES);
-}
-/** A starting manifest from what the live server and its domain reveal. */
-export async function draftManifest(url) {
-    const client = new McpClient(url);
-    const init = await client.initialize().catch(() => null);
-    const auth = init?.status === 401 ? 'oauth' : 'none';
-    const info = init?.body?.result?.serverInfo ?? {};
-    const host = new URL(url).hostname;
-    const labels = host.split('.');
-    // api.example.com and mcp.example.com usually keep their pages on example.com.
-    const origins = [`https://${host}`, ...(labels.length > 2 ? [`https://${labels.slice(1).join('.')}`] : [])];
-    const origin = origins[origins.length - 1];
-    const found = async (p) => {
-        for (const o of origins) {
-            const r = await fetch(o + p, { method: 'GET', redirect: 'follow' }).catch(() => null);
-            if (r?.ok && !(r.headers.get('content-type') ?? '').includes('json'))
-                return o + p;
-        }
-        return undefined;
-    };
-    const first = async (...paths) => {
-        for (const p of paths) {
-            const hit = await found(p);
-            if (hit)
-                return hit;
-        }
-        return undefined;
-    };
-    const [privacy, support, terms, docs, icon] = await Promise.all([
-        first('/privacy', '/privacy-policy', '/legal/privacy'),
-        first('/support', '/contact', '/help'),
-        first('/terms', '/terms-of-service', '/legal/terms'),
-        first('/llms.txt', '/docs'),
-        first('/icon-512.png', '/icon.png', '/apple-touch-icon.png'),
-    ]);
-    return {
-        $schema: SCHEMA_URL,
-        name: String(info.name ?? new URL(url).hostname.split('.')[0]),
-        title: String(info.title ?? info.name ?? ''),
-        subtitle: '',
-        oneLiner: '',
-        description: '',
-        server: { url, auth },
-        author: { name: '', url: origin },
-        links: { website: origin, support, privacy, terms, docs },
-        icon,
-        stores: ['mcp-registry', 'chatgpt', 'claude-connectors', 'cursor', 'muse'],
-    };
-}

package/dist/mcp-client.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Just enough of a streamable-HTTP MCP client to inspect a server the way a
+ * store's scanner does: plain POSTs, JSON or SSE replies, a session id if the
+ * server hands one out.
+ */
+export interface RpcReply {
+    status: number;
+    contentType: string;
+    body: any;
+    headers: Headers;
+}
+export declare class McpClient {
+    readonly url: string;
+    private extraHeaders;
+    private timeoutMs;
+    private session;
+    private id;
+    constructor(url: string, extraHeaders?: Record<string, string>, timeoutMs?: number);
+    request(method: string, params?: unknown, opts?: {
+        notification?: boolean;
+        url?: string;
+    }): Promise<RpcReply>;
+    initialize(): Promise<RpcReply>;
+}

package/dist/mcp-server.d.ts

@@ -0,0 +1 @@
+export declare function serve(): Promise<void>;

package/dist/packs.d.ts

@@ -0,0 +1,32 @@
+import type { Manifest, StoreId, Tool } from './types.js';
+export interface Pack {
+    files: {
+        path: string;
+        content: string;
+    }[];
+    problems: string[];
+    todo: string[];
+}
+/** "Add the user's…" → "adds the user's…"; leaves non-verb openings alone. */
+declare function thirdPerson(s: string): string | null;
+/** One-sentence drafts from the declared hints and the tool's own description. Review them: they are a start, not an answer. */
+declare function justify(t: Tool, product: string, own?: {
+    readOnly?: string;
+    openWorld?: string;
+    destructive?: string;
+}): {
+    read_only_justification: string;
+    open_world_justification: string;
+    destructive_justification: string;
+};
+export declare function chatgptPack(m: Manifest, token?: string): Promise<Pack>;
+export declare function claudePack(m: Manifest, token?: string): Promise<Pack>;
+export declare function simplePack(m: Manifest, store: StoreId): Promise<Pack>;
+/** The long tail: directories that only take a web form. One sheet with every value to paste. */
+export declare function directoriesPack(m: Manifest): Pack;
+export declare function writePack(pack: Pack, dir?: string): Promise<string[]>;
+export declare const _test: {
+    thirdPerson: typeof thirdPerson;
+    justify: typeof justify;
+};
+export {};

package/dist/preflight.d.ts

@@ -0,0 +1,9 @@
+import { type PreflightResult } from './core.js';
+import type { Manifest, StoreId } from './types.js';
+export type { PreflightResult } from './core.js';
+/** Preflight with everything Node can check, the TLS 1.2 handshake included. */
+export declare function preflight(m: Manifest, opts?: {
+    stores?: StoreId[];
+    register?: boolean;
+    token?: string;
+}): Promise<PreflightResult>;

package/dist/preflight.js

@@ -1,44 +1,6 @@
-import { authChecks } from './checks/auth.js';
-import { listingChecks, repoChecks } from './checks/listing.js';
-import { serverChecks } from './checks/server.js';
-import { toolChecks } from './checks/tools.js';
-import { storesOf } from './manifest.js';
-/** Things no script can see, which have still cost real submissions. */
-function reminders(m, stores) {
-    const r = [];
-    if (m.server.auth === 'oauth') {
-        r.push('Give reviewers a demo account a stranger can use: email and password (not your Google or SSO login), email already confirmed, no 2FA or SMS, seeded with data for every test case. Re-check the seed right before submitting.');
-        r.push('Sign in through your OAuth flow once as a brand-new user. A blank post-sign-in redirect stranded a ChatGPT reviewer between registration and consent.');
-    }
-    if (stores.some((s) => s === 'chatgpt' || s === 'claude-connectors')) {
-        r.push('If a tool writes somewhere public (posts, sends, publishes), give reviewers a safe target: a sandbox account or a "playground" option that validates and then discards. Reviewers test writes; they shouldn’t post to a real timeline.');
-    }
-    if (stores.includes('chatgpt')) {
-        r.push('ChatGPT needs a demo video recorded in developer mode that shows the tools your test cases use. Re-record it whenever tools change.');
-        r.push('After "Submit for Review" the ChatGPT portal shows nothing for about 20 seconds. Confirm the status on the plugins list, not the button.');
-        r.push('Tool-annotation justifications are cut at 200 characters without warning.');
-        r.push('ChatGPT allows one version in review at a time. To change a submission, Cancel Review and resubmit the same draft.');
-    }
-    if (stores.includes('claude-connectors') || stores.includes('claude-plugins')) {
-        if (stores.includes('claude-connectors'))
-            r.push('Claude connectors are submitted from an organisation’s admin settings (claude.ai/directory/manage), so you need admin rights in a paid org. The tool list is synced from your server when you submit; it is not an editable field.');
-        if (stores.includes('claude-plugins'))
-            r.push('Run "claude plugin validate --strict" in the plugin repo; the portal validates every commit on the branch it tracks.');
-        r.push('Claude: "Passed review" is not the same as listed. Check claude.ai/directory for your listing after approval; with the new portal you choose when to publish.');
-    }
-    return r;
-}
-export async function preflight(m, opts = {}) {
-    const stores = opts.stores?.length ? opts.stores : storesOf(m);
-    const auth = m.server.auth ?? 'none';
-    const server = await serverChecks(m.server.url, auth, opts.token);
-    const [authC, listing, repo] = await Promise.all([
-        auth === 'oauth' ? authChecks(m.server.url, { register: opts.register }) : Promise.resolve([]),
-        listingChecks(m, server.tools, stores),
-        repoChecks(m, stores),
-    ]);
-    const all = [...server.checks, ...authC, ...toolChecks(server.tools), ...listing, ...repo];
-    // Keep checks that apply to every store or to one we're submitting to.
-    const checks = all.filter((c) => !c.stores?.length || c.stores.some((s) => stores.includes(s)));
-    return { checks, reminders: reminders(m, stores), stores };
+import { tls12Check } from './checks/tls.js';
+import { preflight as core } from './core.js';
+/** Preflight with everything Node can check, the TLS 1.2 handshake included. */
+export function preflight(m, opts = {}) {
+    return core(m, { ...opts, extraChecks: [tls12Check] });
 }

package/dist/publish.d.ts

@@ -0,0 +1,52 @@
+import type { Manifest, StoreId } from './types.js';
+export interface PublishResult {
+    store: StoreId;
+    done: boolean;
+    lines: string[];
+    url?: string;
+}
+export declare function registryName(m: Manifest): string;
+export declare function serverJson(m: Manifest): {
+    version: string;
+    remotes: {
+        type: string;
+        url: string;
+    }[];
+    repository?: {
+        url: string;
+        source: string;
+    } | undefined;
+    websiteUrl?: string | undefined;
+    $schema: string;
+    name: string;
+    title: string;
+    description: string;
+};
+declare function grokEntry(m: Manifest, sha: string): {
+    keywords: string[];
+    domains: string[];
+    homepage?: string | undefined;
+    name: string;
+    description: string;
+    category: string;
+    source: {
+        source: string;
+        url: string;
+        sha: string;
+    };
+};
+/** Adds or re-pins our entry without reformatting the rest of the file. */
+declare function editMarketplace(text: string, entry: ReturnType<typeof grokEntry>): {
+    text: string;
+    mode: 'add' | 'bump' | 'same';
+};
+export declare function publish(m: Manifest, store: StoreId, opts?: {
+    yes?: boolean;
+    dir?: string;
+}): Promise<PublishResult>;
+export declare const _test: {
+    editMarketplace: typeof editMarketplace;
+    grokEntry: typeof grokEntry;
+    nextPrerelease: (v: string) => string;
+};
+export {};

package/dist/report.d.ts

@@ -0,0 +1,4 @@
+import type { PreflightResult } from './preflight.js';
+export declare function printPreflight(r: PreflightResult, opts?: {
+    verbose?: boolean;
+}): void;

package/dist/submissions.d.ts

@@ -0,0 +1,33 @@
+import type { Manifest, StoreId } from './types.js';
+export interface Submission {
+    store: StoreId;
+    kind: 'new' | 'update' | 'resubmission';
+    version?: string;
+    submittedOn: string;
+    status: 'waiting' | 'approved' | 'rejected' | 'withdrawn';
+    decidedOn?: string;
+    reviewTimes?: {
+        token: string;
+        shareUrl: string | null;
+    };
+}
+export declare function load(dir?: string): Promise<Submission[]>;
+export declare function recordSubmitted(m: Manifest, store: StoreId, opts: {
+    date?: string;
+    kind?: Submission['kind'];
+    version?: string;
+    appId?: string;
+    share?: boolean;
+    token?: string;
+}, dir?: string): Promise<{
+    submission: Submission;
+    note: string;
+}>;
+export declare function recordDecision(store: StoreId, outcome: 'approved' | 'rejected' | 'withdrawn', date?: string, dir?: string): Promise<Submission>;
+export interface StatusRow {
+    submission: Submission;
+    days: number;
+    typical: string | null;
+}
+/** Refreshes each waiting submission from Review Times (the directory watch may have closed it) and adds the store's typical wait. */
+export declare function status(dir?: string): Promise<StatusRow[]>;

package/dist/types.d.ts

@@ -0,0 +1,97 @@
+export type Level = 'pass' | 'warn' | 'fail' | 'skip';
+export interface Check {
+    id: string;
+    level: Level;
+    title: string;
+    /** What we found. */
+    detail?: string;
+    /** How to fix it, when it isn't a pass. */
+    fix?: string;
+    /** The stores this matters for; empty means all. */
+    stores?: StoreId[];
+}
+export type StoreId = 'mcp-registry' | 'chatgpt' | 'claude-connectors' | 'claude-plugins' | 'cursor' | 'grok' | 'docker' | 'muse' | 'smithery' | 'glama' | 'cline' | 'lobehub' | 'awesome-mcp-servers' | 'awesome-remote-mcp-servers';
+export declare const STORE_NAMES: Record<StoreId, string>;
+export interface Manifest {
+    $schema?: string;
+    name: string;
+    title: string;
+    subtitle?: string;
+    oneLiner?: string;
+    description?: string;
+    category?: string;
+    server: {
+        url: string;
+        auth?: 'none' | 'oauth';
+    };
+    repository?: string;
+    author?: {
+        name: string;
+        url?: string;
+    };
+    links?: {
+        website?: string;
+        support?: string;
+        privacy?: string;
+        terms?: string;
+        docs?: string;
+    };
+    icon?: string;
+    prompts?: string[];
+    stores?: StoreId[];
+    /** Review test cases: ChatGPT wants exactly 5 positive and 3 negative. */
+    tests?: {
+        positive?: {
+            scenario: string;
+            prompt: string;
+            tools: string[];
+            expected: string;
+        }[];
+        negative?: {
+            scenario: string;
+            prompt: string;
+        }[];
+    };
+    /** Hand-written ChatGPT hint justifications, per tool; they replace mcplane's drafts. */
+    justifications?: Record<string, {
+        readOnly?: string;
+        openWorld?: string;
+        destructive?: string;
+    }>;
+    /** Your server's version, for the MCP Registry and your own records. */
+    version?: string;
+    /** MCP Registry overrides: reverse-DNS name (io.github.<owner>/<name> by default), description (100 max), file path. */
+    registry?: {
+        name?: string;
+        description?: string;
+        file?: string;
+    };
+    /** Grok marketplace entry overrides. */
+    grok?: {
+        description?: string;
+        category?: string;
+        keywords?: string[];
+        domains?: string[];
+    };
+    /** Named workflows, run with "mcplane <lane>": each step is a command line without "mcplane". */
+    lanes?: Record<string, string[]>;
+    /** How reviewers get in, for servers behind sign-in. Never put the password here; say where it lives. */
+    reviewerAccess?: string;
+}
+export interface Tool {
+    name: string;
+    title?: string;
+    description?: string;
+    inputSchema?: {
+        properties?: Record<string, unknown>;
+        required?: string[];
+    };
+    outputSchema?: unknown;
+    annotations?: {
+        title?: string;
+        readOnlyHint?: boolean;
+        destructiveHint?: boolean;
+        idempotentHint?: boolean;
+        openWorldHint?: boolean;
+    };
+}

package/dist/version.d.ts

@@ -0,0 +1 @@
+export declare const VERSION = "0.3.1";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = '0.2.0';
+export const VERSION = '0.3.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcplane",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "fastlane for MCP servers: preflight against every store's rejection causes, publish where you can, prepare the rest, track every review.",
   "type": "module",
   "bin": {
@@ -52,5 +52,13 @@
     "url": "https://github.com/stevysmith/mcplane/issues"
   },
   "author": "Steve Smith",
-  "mcpName": "io.github.stevysmith/mcplane"
+  "mcpName": "io.github.stevysmith/mcplane",
+  "exports": {
+    "./core": {
+      "types": "./dist/core.d.ts",
+      "default": "./dist/core.js"
+    },
+    "./schema.json": "./schema.json",
+    "./package.json": "./package.json"
+  }
 }