offerguard-mcp-server 0.2.0

package/README.md

@@ -0,0 +1,76 @@
+# OfferGuard MCP Server
+
+OfferGuard MCP Server is a real Model Context Protocol service for internship offer risk auditing. It exposes deterministic OfferGuard tools through MCP Streamable HTTP, legacy SSE, and stdio transports.
+
+## Tools
+
+- `risk_term_matcher`: matches JD risk terms and returns severity, evidence, and trigger reasons.
+- `internship_compliance_checker`: checks unpaid trials, deposits, training loans, agreements, work hours, salary payment, IP ownership, and relocation risk.
+- `offer_score_calculator`: returns seven-dimension scores, overall score, risk level, and recommendation route.
+
+## Local Run
+
+```bash
+npm install
+npm test
+npm start
+```
+
+Default local HTTP endpoints:
+
+- Health: `http://127.0.0.1:3000/health`
+- MCP Streamable HTTP: `http://127.0.0.1:3000/mcp`
+- Legacy SSE: `http://127.0.0.1:3000/sse`
+- Legacy messages: `http://127.0.0.1:3000/messages`
+
+Stdio entry for MCP hosting platforms:
+
+```bash
+npx -y offerguard-mcp-server@0.2.0
+```
+
+## XFYun MCP Hosting
+
+Use the XFYun MCP hosting platform to host this package as a tool-type MCP server.
+
+Recommended cloud hosting configuration:
+
+```text
+command: npx
+args: -y offerguard-mcp-server@0.2.0
+env: {}
+```
+
+After hosting, the tool list must show:
+
+- `risk_term_matcher`
+- `internship_compliance_checker`
+- `offer_score_calculator`
+
+If the hosted MCP detail page does not show these three tool names, do not connect it to the main OfferGuard workflow.
+
+## XFYun Workflow Integration
+
+Place the hosted MCP tool nodes after the material-completeness gate and before the seven-dimension scorer:
+
+```text
+02_资料完整性门禁
+-> MCP: risk_term_matcher
+-> MCP: internship_compliance_checker
+-> MCP: offer_score_calculator
+-> 04_七维结构化评分器
+```
+
+The final report must include `MCP工具审计摘要` with:
+
+- matched risk terms from `risk_term_matcher.risk_terms`
+- compliance red lines from `internship_compliance_checker.red_lines`
+- score, risk level, and route from `offer_score_calculator`
+
+If MCP returns empty data or errors, stop the workflow and show:
+
+```text
+MCP 工具连接失败，暂不能生成 OfferGuard 风险报告。请稍后重试或检查 MCP Server 状态。
+```
+
+Do not continue with a prompt-only fallback.

package/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "offerguard-mcp-server",
+  "version": "0.2.0",
+  "private": false,
+  "type": "module",
+  "description": "OfferGuard MCP Server for internship offer risk auditing.",
+  "scripts": {
+    "start": "node src/server.js",
+    "stdio": "node src/stdio.js",
+    "test": "node test/mcp-protocol.test.js"
+  },
+  "bin": {
+    "offerguard-mcp-server": "src/stdio.js"
+  },
+  "files": [
+    "src",
+    "README.md"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.17.5",
+    "express": "^5.1.0",
+    "zod": "^3.25.76"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/src/offerguard-tools.js

@@ -0,0 +1,426 @@
+const SEVERITY_WEIGHT = {
+  low: 1,
+  medium: 2,
+  high: 3,
+  critical: 4
+};
+
+const RISK_TERMS = [
+  {
+    term: "无薪试岗",
+    severity: "critical",
+    category: "合规红线",
+    reason: "试岗或实习期间不支付报酬，学生应优先拒绝或要求书面说明。",
+    aliases: ["试岗无薪", "无薪实习", "不发薪", "不支付薪资", "无报酬试用"]
+  },
+  {
+    term: "押金",
+    severity: "critical",
+    category: "合规红线",
+    reason: "要求学生缴纳押金、保证金或类似费用属于高风险信号。",
+    aliases: ["保证金", "服装费", "工牌费", "设备押金", "入职收费"]
+  },
+  {
+    term: "培训贷",
+    severity: "critical",
+    category: "合规红线",
+    reason: "把入职、培训或实习机会与贷款绑定，存在明显求职风险。",
+    aliases: ["贷款培训", "分期培训", "培训分期"]
+  },
+  {
+    term: "薪资面议",
+    severity: "medium",
+    category: "薪资透明",
+    reason: "薪资结构不透明，面试前需要确认日薪、发放周期和绩效占比。",
+    aliases: ["待遇面议", "薪酬面议", "工资面议"]
+  },
+  {
+    term: "弹性工作",
+    severity: "medium",
+    category: "工作强度",
+    reason: "弹性工作可能掩盖加班或随时响应要求，需要核实边界。",
+    aliases: ["弹性上班", "时间灵活"]
+  },
+  {
+    term: "抗压强",
+    severity: "medium",
+    category: "工作强度",
+    reason: "强调抗压通常意味着强节奏或高不确定性任务。",
+    aliases: ["抗压能力强", "能吃苦", "高压环境"]
+  },
+  {
+    term: "狼性文化",
+    severity: "high",
+    category: "组织文化",
+    reason: "狼性、强结果导向等表述可能对应高压管理和工作边界模糊。",
+    aliases: ["狼性", "强结果导向", "末位淘汰"]
+  },
+  {
+    term: "快速成长",
+    severity: "low",
+    category: "成长承诺",
+    reason: "快速成长本身不是风险，但若缺少导师和产出机制，容易变成空泛承诺。",
+    aliases: ["高速成长", "成长空间大"]
+  },
+  {
+    term: "加班",
+    severity: "medium",
+    category: "工作强度",
+    reason: "需要确认加班频率、调休、补贴以及是否影响课程安排。",
+    aliases: ["晚间在线", "周末响应", "随叫随到", "996", "大小周"]
+  },
+  {
+    term: "转正不明",
+    severity: "medium",
+    category: "转正路径",
+    reason: "转正条件不清晰会影响学生对机会成本的判断。",
+    aliases: ["表现优秀可转正", "有转正机会", "转正另议"]
+  },
+  {
+    term: "职责泛化",
+    severity: "medium",
+    category: "岗位边界",
+    reason: "职责过泛会降低成长确定性，也容易落入杂活型实习。",
+    aliases: ["其他临时工作", "完成领导安排", "综合事务", "多任务协同"]
+  },
+  {
+    term: "作品归属公司",
+    severity: "high",
+    category: "知识产权",
+    reason: "作品、代码或账号归属不清会影响简历展示和后续作品集使用。",
+    aliases: ["作品版权归公司", "代码归公司", "账号归公司", "不得对外展示"]
+  },
+  {
+    term: "自带设备",
+    severity: "medium",
+    category: "资源支持",
+    reason: "要求自带电脑或设备，需要确认补贴、数据安全和损坏责任。",
+    aliases: ["自带电脑", "自备电脑", "自备设备"]
+  }
+];
+
+const COMPLIANCE_RULES = [
+  {
+    id: "unpaid_trial",
+    label: "无薪试岗/无薪实习",
+    severity: "critical",
+    patterns: ["无薪试岗", "试岗无薪", "无薪实习", "不发薪", "不支付薪资", "无报酬试用"],
+    action: "建议拒绝，除非对方提供合法、明确、书面的报酬与协议安排。"
+  },
+  {
+    id: "deposit_or_fee",
+    label: "押金/保证金/入职收费",
+    severity: "critical",
+    patterns: ["押金", "保证金", "服装费", "工牌费", "设备押金", "入职收费"],
+    action: "建议拒绝，不应为获得实习机会提前缴费。"
+  },
+  {
+    id: "training_loan",
+    label: "培训贷/分期培训",
+    severity: "critical",
+    patterns: ["培训贷", "贷款培训", "分期培训", "培训分期"],
+    action: "建议拒绝，并保留沟通记录。"
+  },
+  {
+    id: "work_intensity",
+    label: "工作时长和响应边界不清",
+    severity: "high",
+    patterns: ["996", "大小周", "随叫随到", "晚间在线", "周末响应", "高强度加班"],
+    action: "必须在面试中确认工作时长、调休和补贴规则。"
+  },
+  {
+    id: "ip_ownership",
+    label: "作品/代码/账号归属不清",
+    severity: "high",
+    patterns: ["作品归属公司", "作品版权归公司", "代码归公司", "账号归公司", "不得对外展示"],
+    action: "必须要求写入协议，确认可否用于简历、作品集或面试展示。"
+  },
+  {
+    id: "remote_or_relocation",
+    label: "异地到岗/驻场安排",
+    severity: "medium",
+    patterns: ["异地到岗", "外派", "驻场", "跨城到岗"],
+    action: "必须确认住宿、交通、保险和安全支持。"
+  }
+];
+
+const ROLE_KEYWORDS = {
+  media: ["新媒体", "运营", "公众号", "小红书", "短视频", "活动策划"],
+  backend: ["Java", "后端", "接口", "MySQL", "Redis", "计算机", "开源"],
+  product: ["产品", "需求", "原型", "用户研究", "数据分析"],
+  design: ["设计", "Figma", "视觉", "作品集", "交互"]
+};
+
+function normalizeText(value) {
+  if (!value) return "";
+  if (typeof value === "string") return value;
+  return JSON.stringify(value);
+}
+
+function clamp(score) {
+  return Math.max(0, Math.min(100, Math.round(score)));
+}
+
+function includesAny(text, patterns) {
+  return patterns.some(pattern => text.includes(pattern));
+}
+
+function extractEvidence(text, pattern) {
+  const index = text.indexOf(pattern);
+  if (index < 0) return "";
+  const start = Math.max(0, index - 24);
+  const end = Math.min(text.length, index + pattern.length + 36);
+  return text.slice(start, end).replace(/\s+/g, " ").trim();
+}
+
+function findFirstAlias(text, term) {
+  const patterns = [term.term, ...term.aliases];
+  return patterns.find(pattern => text.includes(pattern));
+}
+
+function countBySeverity(items) {
+  return items.reduce(
+    (acc, item) => {
+      acc[item.severity] += 1;
+      return acc;
+    },
+    { low: 0, medium: 0, high: 0, critical: 0 }
+  );
+}
+
+function highestSeverity(items) {
+  return items.reduce((highest, item) => {
+    return SEVERITY_WEIGHT[item.severity] > SEVERITY_WEIGHT[highest]
+      ? item.severity
+      : highest;
+  }, "low");
+}
+
+function salaryIsExplicit(text) {
+  return /(\d{2,4}\s*[-~至到]\s*\d{2,4}\s*元?\/?(天|日|月)?)|(\d{2,4}\s*元\/?(天|日))|(\d{3,5}\s*\/月)/.test(text);
+}
+
+function hasAgreement(text) {
+  return includesAny(text, ["实习协议", "三方协议", "劳动合同", "书面协议", "电子签"]);
+}
+
+function hasMentor(text) {
+  return includesAny(text, ["导师", "带教", "mentor", "主管指导", "代码评审", "培训体系"]);
+}
+
+function hasConversionPath(text) {
+  return includesAny(text, ["转正标准", "转正流程", "考核指标", "留用", "转正名额"]);
+}
+
+function roleMatchBonus(jdText, studentText) {
+  const keywordGroups = Object.values(ROLE_KEYWORDS);
+  return keywordGroups.some(keywords => keywords.some(word => jdText.includes(word)) && keywords.some(word => studentText.includes(word)))
+    ? 10
+    : 0;
+}
+
+export function matchRiskTerms(input) {
+  const jdText = normalizeText(input.jdText ?? input.text ?? input);
+  const matches = RISK_TERMS.map(term => {
+    const matched = findFirstAlias(jdText, term);
+    if (!matched) return null;
+    return {
+      term: term.term,
+      matched_text: matched,
+      severity: term.severity,
+      category: term.category,
+      evidence: extractEvidence(jdText, matched),
+      trigger_reason: term.reason
+    };
+  }).filter(Boolean);
+
+  const severity_counts = countBySeverity(matches);
+  const penalty = matches.reduce((sum, item) => sum + SEVERITY_WEIGHT[item.severity] * 4, 0);
+
+  return {
+    tool: "risk_term_matcher",
+    version: "0.2.0",
+    risk_terms: matches,
+    summary: {
+      total_hits: matches.length,
+      severity_counts,
+      highest_severity: matches.length ? highestSeverity(matches) : "none",
+      risk_score_penalty: Math.min(45, penalty)
+    }
+  };
+}
+
+export function checkInternshipCompliance(input) {
+  const text = [input.jdText, input.offerText, input.extraText]
+    .map(normalizeText)
+    .filter(Boolean)
+    .join("\n");
+
+  const flags = COMPLIANCE_RULES.map(rule => {
+    const matched = rule.patterns.find(pattern => text.includes(pattern));
+    if (!matched) return null;
+    return {
+      id: rule.id,
+      label: rule.label,
+      severity: rule.severity,
+      matched_text: matched,
+      evidence: extractEvidence(text, matched),
+      recommended_action: rule.action
+    };
+  }).filter(Boolean);
+
+  const missing_items = [];
+  if (!salaryIsExplicit(text) || includesAny(text, ["薪资面议", "待遇面议", "工资面议"])) {
+    missing_items.push({
+      id: "salary_structure",
+      label: "薪资结构/发放周期",
+      severity: "medium",
+      recommended_question: "请问日薪或月薪、发放时间、绩效占比和是否有扣款规则分别是什么？"
+    });
+  }
+  if (!hasAgreement(text)) {
+    missing_items.push({
+      id: "written_agreement",
+      label: "书面实习协议",
+      severity: "high",
+      recommended_question: "入职前是否签署书面实习协议，协议中是否包含薪资、工时、保险和作品归属？"
+    });
+  }
+  if (!hasConversionPath(text) && includesAny(text, ["转正", "留用"])) {
+    missing_items.push({
+      id: "conversion_criteria",
+      label: "转正标准",
+      severity: "medium",
+      recommended_question: "转正考核指标、名额、周期和审批人分别是什么？"
+    });
+  }
+
+  const red_lines = flags.filter(flag => flag.severity === "critical");
+
+  return {
+    tool: "internship_compliance_checker",
+    version: "0.2.0",
+    compliance_flags: flags,
+    red_lines,
+    missing_items,
+    summary: {
+      red_line_count: red_lines.length,
+      high_risk_count: flags.filter(flag => flag.severity === "high").length,
+      missing_item_count: missing_items.length,
+      can_generate_report: red_lines.length === 0
+    }
+  };
+}
+
+export function calculateOfferScore(input) {
+  const jdText = normalizeText(input.jdText ?? input.jobProfile);
+  const studentText = normalizeText(input.studentProfile);
+  const riskResult = input.riskTermResult?.risk_terms ? input.riskTermResult : matchRiskTerms({ jdText });
+  const complianceResult = input.complianceResult?.summary ? input.complianceResult : checkInternshipCompliance({ jdText });
+
+  const riskTerms = riskResult.risk_terms ?? [];
+  const flags = complianceResult.compliance_flags ?? [];
+  const missingItems = complianceResult.missing_items ?? [];
+  const criticalCount = complianceResult.summary?.red_line_count ?? 0;
+  const highCount = flags.filter(flag => flag.severity === "high").length;
+  const mediumCount = [
+    ...riskTerms.filter(item => item.severity === "medium"),
+    ...missingItems.filter(item => item.severity === "medium")
+  ].length;
+
+  const explicitSalary = salaryIsExplicit(jdText);
+  const mentor = hasMentor(jdText);
+  const conversionPath = hasConversionPath(jdText);
+  const projectValue = includesAny(jdText, ["上线", "核心项目", "真实项目", "可量化", "作品", "数据复盘"]);
+  const repetitive = includesAny(jdText, ["资料整理", "简单重复", "打杂", "行政杂务", "搬运"]);
+  const overtime = includesAny(jdText, ["996", "大小周", "随叫随到", "晚间在线", "周末响应", "加班"]);
+  const wantsStableHours = includesAny(studentText, ["不希望长期夜间", "不接受加班", "课业", "考研", "保研"]);
+
+  const dimensions = [
+    {
+      key: "role_match",
+      name: "岗位匹配",
+      score: clamp(68 + roleMatchBonus(jdText, studentText) - (repetitive ? 8 : 0)),
+      rationale: "根据岗位关键词与学生经历方向的重合度计算。"
+    },
+    {
+      key: "growth_value",
+      name: "成长价值",
+      score: clamp(65 + (mentor ? 12 : 0) + (projectValue ? 10 : 0) - (repetitive ? 18 : 0)),
+      rationale: "导师、真实项目和可沉淀产出会提升成长价值。"
+    },
+    {
+      key: "salary_transparency",
+      name: "薪资透明",
+      score: clamp(58 + (explicitSalary ? 20 : -12) - (includesAny(jdText, ["薪资面议", "待遇面议"]) ? 15 : 0)),
+      rationale: "薪资金额、发放周期和绩效占比越明确，透明度越高。"
+    },
+    {
+      key: "work_intensity",
+      name: "工作强度",
+      score: clamp(78 - (overtime ? 25 : 0) - (wantsStableHours && overtime ? 15 : 0)),
+      rationale: "加班、随叫随到和学生时间偏好冲突会拉低该项。"
+    },
+    {
+      key: "compliance_safety",
+      name: "合规安全",
+      score: clamp(86 - criticalCount * 55 - highCount * 22 - mediumCount * 6 - missingItems.length * 5),
+      rationale: "无薪试岗、押金、培训贷等红线优先级最高。"
+    },
+    {
+      key: "conversion_clarity",
+      name: "转正清晰",
+      score: clamp(62 + (conversionPath ? 20 : 0) - (includesAny(jdText, ["转正另议", "表现优秀可转正", "有转正机会"]) ? 15 : 0)),
+      rationale: "有量化转正标准和流程时分数更高。"
+    },
+    {
+      key: "resume_value",
+      name: "简历增益",
+      score: clamp(66 + (projectValue ? 15 : 0) + (mentor ? 5 : 0) - (repetitive ? 20 : 0)),
+      rationale: "能否形成项目、数据、作品或证明材料决定简历增益。"
+    }
+  ];
+
+  const overall_score = clamp(dimensions.reduce((sum, item) => sum + item.score, 0) / dimensions.length);
+  let risk_level = "low";
+  let route = "advance";
+  let one_sentence_reason = "岗位信息较完整，暂未发现高风险红线，可继续推进并验证细节。";
+
+  if (criticalCount > 0) {
+    risk_level = "critical";
+    route = "reject";
+    one_sentence_reason = "命中实习合规红线，建议停止推进并保留沟通证据。";
+  } else if (highCount > 0 || riskTerms.some(item => item.severity === "high")) {
+    risk_level = "high";
+    route = "verify";
+    one_sentence_reason = "存在高风险信号，必须通过面试追问和书面材料验证后再决定。";
+  } else if (overall_score < 55) {
+    risk_level = "high";
+    route = "reject";
+    one_sentence_reason = "综合分较低且成长、合规或透明度不足，不建议优先选择。";
+  } else if (mediumCount >= 2 || missingItems.length >= 2 || overall_score < 73) {
+    risk_level = "medium";
+    route = explicitSalary ? "verify" : "negotiate";
+    one_sentence_reason = "信息仍有缺口或中风险较多，建议先验证薪资、工时、转正和协议。";
+  }
+
+  return {
+    tool: "offer_score_calculator",
+    version: "0.2.0",
+    overall_score,
+    risk_level,
+    route,
+    one_sentence_reason,
+    dimensions,
+    decision_rules_triggered: {
+      critical_compliance_first: criticalCount > 0,
+      high_risk_requires_verification: highCount > 0 || riskTerms.some(item => item.severity === "high"),
+      missing_information_requires_followup: missingItems.length >= 2
+    },
+    required_followup_questions: [
+      ...missingItems.map(item => item.recommended_question),
+      ...(overtime ? ["请问实习生平均每周工作时长、加班频率、调休和补贴规则分别是什么？"] : []),
+      ...(projectValue ? [] : ["这个岗位三个月内可以沉淀哪些项目、数据或作品证明？"])
+    ].slice(0, 6)
+  };
+}

package/src/server.js

@@ -0,0 +1,229 @@
+import { randomUUID } from "node:crypto";
+import { pathToFileURL } from "node:url";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
+import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import * as z from "zod/v4";
+import {
+  calculateOfferScore,
+  checkInternshipCompliance,
+  matchRiskTerms
+} from "./offerguard-tools.js";
+
+const SERVICE_NAME = "OfferGuardMCP";
+const SERVICE_VERSION = "0.2.0";
+
+function jsonToolResult(result) {
+  return {
+    content: [
+      {
+        type: "text",
+        text: JSON.stringify(result, null, 2)
+      }
+    ],
+    structuredContent: result
+  };
+}
+
+export function createOfferGuardMcpServer() {
+  const server = new McpServer({
+    name: SERVICE_NAME,
+    version: SERVICE_VERSION
+  });
+
+  server.registerTool(
+    "risk_term_matcher",
+    {
+      description: "Match internship JD risk terms and return severity, source evidence, and trigger reasons.",
+      inputSchema: {
+        jdText: z.string().min(1).describe("Raw internship JD or offer text.")
+      }
+    },
+    async input => jsonToolResult(matchRiskTerms(input))
+  );
+
+  server.registerTool(
+    "internship_compliance_checker",
+    {
+      description: "Check internship compliance red lines such as unpaid trials, deposits, training loans, work hours, salary payment, agreements, and IP ownership.",
+      inputSchema: {
+        jdText: z.string().min(1).describe("Raw internship JD text."),
+        offerText: z.string().optional().describe("Optional offer or HR message text."),
+        extraText: z.string().optional().describe("Optional extra context from the student.")
+      }
+    },
+    async input => jsonToolResult(checkInternshipCompliance(input))
+  );
+
+  server.registerTool(
+    "offer_score_calculator",
+    {
+      description: "Calculate OfferGuard seven-dimension scores, overall risk level, and recommendation route.",
+      inputSchema: {
+        jdText: z.string().min(1).describe("Raw internship JD text."),
+        studentProfile: z.union([z.string(), z.record(z.string(), z.any())]).describe("Student profile, resume summary, preferences, and risk tolerance."),
+        jobProfile: z.union([z.string(), z.record(z.string(), z.any())]).optional().describe("Optional parsed job profile."),
+        riskTermResult: z.record(z.string(), z.any()).optional().describe("Optional output from risk_term_matcher."),
+        complianceResult: z.record(z.string(), z.any()).optional().describe("Optional output from internship_compliance_checker.")
+      }
+    },
+    async input => jsonToolResult(calculateOfferScore(input))
+  );
+
+  return server;
+}
+
+export function createApp({ host = process.env.HOST ?? "127.0.0.1" } = {}) {
+  const app = createMcpExpressApp({ host });
+  const transports = {};
+
+  app.get("/health", (req, res) => {
+    res.json({
+      service: SERVICE_NAME,
+      version: SERVICE_VERSION,
+      status: "ok",
+      transports: ["streamable-http", "sse-legacy"],
+      tools: [
+        "risk_term_matcher",
+        "internship_compliance_checker",
+        "offer_score_calculator"
+      ]
+    });
+  });
+
+  app.all("/mcp", async (req, res) => {
+    try {
+      const sessionId = req.headers["mcp-session-id"];
+      let transport;
+
+      if (sessionId && transports[sessionId]) {
+        const existingTransport = transports[sessionId];
+        if (!(existingTransport instanceof StreamableHTTPServerTransport)) {
+          res.status(400).json({
+            jsonrpc: "2.0",
+            error: {
+              code: -32000,
+              message: "Bad Request: Session exists but uses a different transport protocol"
+            },
+            id: null
+          });
+          return;
+        }
+        transport = existingTransport;
+      } else if (!sessionId && req.method === "POST" && isInitializeRequest(req.body)) {
+        transport = new StreamableHTTPServerTransport({
+          sessionIdGenerator: () => randomUUID(),
+          onsessioninitialized: initializedSessionId => {
+            transports[initializedSessionId] = transport;
+          }
+        });
+
+        transport.onclose = () => {
+          const sid = transport.sessionId;
+          if (sid && transports[sid]) {
+            delete transports[sid];
+          }
+        };
+
+        const server = createOfferGuardMcpServer();
+        await server.connect(transport);
+      } else {
+        res.status(400).json({
+          jsonrpc: "2.0",
+          error: {
+            code: -32000,
+            message: "Bad Request: No valid session ID provided"
+          },
+          id: null
+        });
+        return;
+      }
+
+      await transport.handleRequest(req, res, req.body);
+    } catch (error) {
+      console.error("Error handling /mcp request:", error);
+      if (!res.headersSent) {
+        res.status(500).json({
+          jsonrpc: "2.0",
+          error: {
+            code: -32603,
+            message: "Internal server error"
+          },
+          id: null
+        });
+      }
+    }
+  });
+
+  app.get("/sse", async (req, res) => {
+    const transport = new SSEServerTransport("/messages", res);
+    transports[transport.sessionId] = transport;
+    res.on("close", () => {
+      delete transports[transport.sessionId];
+    });
+
+    const server = createOfferGuardMcpServer();
+    await server.connect(transport);
+  });
+
+  app.post("/messages", async (req, res) => {
+    const sessionId = req.query.sessionId;
+    const existingTransport = transports[sessionId];
+
+    if (!(existingTransport instanceof SSEServerTransport)) {
+      res.status(400).json({
+        jsonrpc: "2.0",
+        error: {
+          code: -32000,
+          message: "Bad Request: No SSE transport found for sessionId"
+        },
+        id: null
+      });
+      return;
+    }
+
+    await existingTransport.handlePostMessage(req, res, req.body);
+  });
+
+  app.closeTransports = async () => {
+    for (const sessionId of Object.keys(transports)) {
+      try {
+        await transports[sessionId].close();
+      } finally {
+        delete transports[sessionId];
+      }
+    }
+  };
+
+  return app;
+}
+
+export function startServer({ port = Number(process.env.PORT ?? 3000), host = process.env.HOST ?? "127.0.0.1" } = {}) {
+  const app = createApp({ host });
+  const httpServer = app.listen(port, host, error => {
+    if (error) {
+      console.error("Failed to start OfferGuard MCP Server:", error);
+      process.exit(1);
+    }
+    console.log(`${SERVICE_NAME} ${SERVICE_VERSION} listening on http://${host}:${port}`);
+    console.log("Streamable HTTP endpoint: /mcp");
+    console.log("Legacy SSE endpoints: /sse and /messages");
+    console.log("Health endpoint: /health");
+  });
+
+  const shutdown = async () => {
+    await app.closeTransports();
+    httpServer.close(() => process.exit(0));
+  };
+
+  process.once("SIGINT", shutdown);
+  process.once("SIGTERM", shutdown);
+
+  return { app, httpServer };
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1]).href) {
+  startServer();
+}

package/src/stdio.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { createOfferGuardMcpServer } from "./server.js";
+
+const server = createOfferGuardMcpServer();
+const transport = new StdioServerTransport();
+
+await server.connect(transport);