onlymcp 0.17.0 → 0.20.0

package/dist/registry/servers.js

@@ -1,259 +0,0 @@
-/**
- * The picture the product is named after: many MCP servers behind one
- * connection. This list backs the rotating tiles in
- * `packages/web/src/components/McpHub.tsx` and the docs page of connectable
- * servers. Since 2026-10-18 it also seeds the server catalogue table
- * (`packages/api/src/catalogue/store.ts`), which an admin edits and which
- * `/api/mcp-catalog` and the "add a server" step of Connect read; only the
- * addresses of this list are trusted for tool hints (api mcp/tool-hints.ts).
- *
- * Every server in the pool was verified, not remembered. Originally
- * (2026-09-05): each URL was pushed through this product's own
- * POST /api/mcp-connections/test, and only the ones that completed an MCP
- * handshake or answered UNAUTHORIZED (which means a real MCP server is
- * there and wants credentials) were listed. Dropped on that evidence:
- * GitLab (mcp.gitlab.com does not resolve), Figma, Google Drive, Slack.
- * Dropped for want of a brand icon: Canva, monday.com.
- * GitLab came back on 2026-10-18 at gitlab.com/api/v4/mcp: an unauthenticated
- * MCP initialize POST answered 401 with a `WWW-Authenticate: Bearer ...
- * resource_metadata=...` header, and the OAuth metadata names a registration
- * endpoint. Gamma joined the same day on the same evidence, with `brand: null`
- * (simple-icons has no Gamma mark; the catalogue draws a letter tile).
- *
- * Re-verified 2026-09-25 for this registry, this time against each
- * vendor's own documentation (`docsUrl` below) AND a fresh local probe: a
- * scratch script POSTed an MCP `initialize` request, unauthenticated, to
- * every URL below. All 17 answered `401` with a `WWW-Authenticate: Bearer`
- * header naming an OAuth protected-resource metadata document (for
- * example `resource_metadata="https://mcp.notion.com/.well-known/oauth-
- * protected-resource/mcp"`), which is exactly what a live MCP server
- * behind OAuth returns - confirming each URL is real and reachable, not
- * only documented. The finer distinction of `auth` below (whether a
- * static bearer token is ALSO accepted, alongside OAuth) came from each
- * vendor's docs, because a 401 alone cannot tell OAuth-only apart from
- * OAuth-or-bearer.
- *
- * One correction from the 2026-09-05 note: this pass found Linear's docs
- * now document `Authorization: Bearer <token>` as an accepted alternative
- * to the interactive OAuth flow. The original spec text (problem #6)
- * called Linear OAuth-only as of that date; either that capability is new,
- * or it was missed in the first pass. `auth` below reflects the current,
- * re-verified state, and this comment records the discrepancy rather than
- * silently overwriting it.
- *
- * The open MCP registry is not a usable source for this list, by the way -
- * anyone may publish there, and a search for "github" returns community
- * wrappers hosted by third parties, not GitHub's own server.
- *
- * `filesystem` and `postgres`, the textbook examples, are absent on purpose:
- * they are local stdio processes, and OnlyMCP deliberately does not run those
- * (a process we spawn on a user's behalf is code execution on our side, see
- * docs/SECURITY.md).
- *
- * The prefixes are real. `github__create_issue` is exactly what a client
- * sees, because the gateway namespaces every proxied tool with the
- * connection's slug (packages/api/src/mcp/gateway.ts).
- */
-export const SERVERS = [
-    {
-        id: 'github',
-        name: 'GitHub',
-        brand: 'github',
-        url: 'https://api.githubcopilot.com/mcp/',
-        auth: 'oauth-or-bearer',
-        docsUrl: 'https://docs.github.com/en/copilot/how-tos/provide-context/use-mcp-in-your-ide/set-up-the-github-mcp-server',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'github',
-    },
-    {
-        id: 'linear',
-        name: 'Linear',
-        brand: 'linear',
-        url: 'https://mcp.linear.app/mcp',
-        auth: 'oauth-or-bearer',
-        docsUrl: 'https://linear.app/docs/mcp',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'linear',
-    },
-    {
-        id: 'notion',
-        name: 'Notion',
-        brand: 'notion',
-        url: 'https://mcp.notion.com/mcp',
-        auth: 'oauth',
-        docsUrl: 'https://developers.notion.com/guides/mcp/get-started-with-mcp',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'notion',
-    },
-    {
-        id: 'sentry',
-        name: 'Sentry',
-        brand: 'sentry',
-        url: 'https://mcp.sentry.dev/mcp',
-        auth: 'oauth',
-        docsUrl: 'https://docs.sentry.io/product/mcp-servers/getting-started/',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'sentry',
-    },
-    {
-        id: 'stripe',
-        name: 'Stripe',
-        brand: 'stripe',
-        url: 'https://mcp.stripe.com',
-        auth: 'oauth-or-bearer',
-        docsUrl: 'https://docs.stripe.com/mcp',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'stripe',
-    },
-    {
-        id: 'supabase',
-        name: 'Supabase',
-        brand: 'supabase',
-        url: 'https://mcp.supabase.com/mcp',
-        auth: 'oauth-or-bearer',
-        docsUrl: 'https://supabase.com/docs/guides/ai-tools/mcp',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'supabase',
-    },
-    {
-        id: 'vercel',
-        name: 'Vercel',
-        brand: 'vercel',
-        url: 'https://mcp.vercel.com',
-        auth: 'oauth',
-        docsUrl: 'https://vercel.com/docs/mcp/vercel-mcp',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'vercel',
-    },
-    {
-        id: 'atlassian',
-        name: 'Atlassian',
-        brand: 'atlassian',
-        url: 'https://mcp.atlassian.com/v2/mcp',
-        auth: 'oauth-or-bearer',
-        docsUrl: 'https://support.atlassian.com/atlassian-rovo-mcp-server/docs/getting-started-with-the-atlassian-remote-mcp-server/',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'atlassian',
-    },
-    {
-        id: 'asana',
-        name: 'Asana',
-        brand: 'asana',
-        // V2. The V1 Beta server (mcp.asana.com/sse) shut down 2026-08-05.
-        url: 'https://mcp.asana.com/v2/mcp',
-        auth: 'oauth',
-        docsUrl: 'https://developers.asana.com/docs/integrating-with-asanas-mcp-server',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'asana',
-    },
-    {
-        id: 'cloudflare',
-        name: 'Cloudflare',
-        brand: 'cloudflare',
-        // The general-purpose one: 2,500+ endpoints across DNS, Workers, R2,
-        // Zero Trust. Cloudflare also hosts 16 narrower servers (docs,
-        // bindings, observability, ...), not used here.
-        url: 'https://mcp.cloudflare.com/mcp',
-        auth: 'oauth',
-        docsUrl: 'https://developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'cloudflare',
-    },
-    {
-        id: 'intercom',
-        name: 'Intercom',
-        brand: 'intercom',
-        url: 'https://mcp.intercom.com/mcp',
-        auth: 'oauth-or-bearer',
-        docsUrl: 'https://developers.intercom.com/docs/guides/mcp',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'intercom',
-    },
-    {
-        id: 'hubspot',
-        name: 'HubSpot',
-        brand: 'hubspot',
-        url: 'https://mcp.hubspot.com',
-        auth: 'oauth',
-        docsUrl: 'https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-the-remote-hubspot-mcp-server',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'hubspot',
-    },
-    {
-        id: 'netlify',
-        name: 'Netlify',
-        brand: 'netlify',
-        url: 'https://netlify-mcp.netlify.app/mcp',
-        auth: 'oauth-or-bearer',
-        docsUrl: 'https://docs.netlify.com/build/build-with-ai/netlify-mcp-server/',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'netlify',
-    },
-    {
-        id: 'neon',
-        name: 'Neon',
-        brand: 'neon',
-        url: 'https://mcp.neon.tech/mcp',
-        auth: 'oauth-or-bearer',
-        docsUrl: 'https://neon.com/docs/ai/connect-mcp-clients-to-neon',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'neon',
-    },
-    {
-        id: 'zapier',
-        name: 'Zapier',
-        brand: 'zapier',
-        url: 'https://mcp.zapier.com/api/v1/connect',
-        auth: 'oauth-or-bearer',
-        docsUrl: 'https://docs.zapier.com/mcp/overview/how-connections-work',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'zapier',
-    },
-    {
-        id: 'webflow',
-        name: 'Webflow',
-        brand: 'webflow',
-        url: 'https://mcp.webflow.com/mcp',
-        auth: 'oauth',
-        docsUrl: 'https://developers.webflow.com/mcp/reference/getting-started',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'webflow',
-    },
-    {
-        id: 'wix',
-        name: 'Wix',
-        brand: 'wix',
-        url: 'https://mcp.wix.com/mcp',
-        auth: 'oauth-or-bearer',
-        docsUrl: 'https://dev.wix.com/docs/overview/ai-the-wix-platform/the-wix-mcp',
-        verifiedOn: '2026-09-25',
-        suggestedSlug: 'wix',
-    },
-    {
-        id: 'gitlab',
-        name: 'GitLab',
-        brand: 'gitlab',
-        // GitLab.com. Self-managed and Dedicated serve the same at https://<host>/api/v4/mcp, which is why the address a
-        // catalogue pick fills into the connection form stays editable (owner decision D3). The token is an OAuth one with
-        // the `mcp` scope (dynamic client registration) or a fine-grained personal access token with the MCP tool resource;
-        // legacy, project and group tokens are refused. On GitLab.com a group owner must allow MCP access for the top-level
-        // group first.
-        url: 'https://gitlab.com/api/v4/mcp',
-        auth: 'oauth-or-bearer',
-        docsUrl: 'https://docs.gitlab.com/user/model_context_protocol/mcp_server/',
-        verifiedOn: '2026-10-18',
-        suggestedSlug: 'gitlab',
-    },
-    {
-        id: 'gamma',
-        name: 'Gamma',
-        brand: null,
-        // "Uses OAuth with Dynamic Client Registration", on all plans.
-        url: 'https://mcp.gamma.app/mcp',
-        auth: 'oauth',
-        docsUrl: 'https://developers.gamma.app/mcp/gamma-mcp-server',
-        verifiedOn: '2026-10-18',
-        suggestedSlug: 'gamma',
-    },
-];
-//# sourceMappingURL=servers.js.map

package/dist/registry/servers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"servers.js","sourceRoot":"","sources":["../../src/registry/servers.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAM,CAAC,MAAM,OAAO,GAA4B;IAC9C;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE,oCAAoC;QACzC,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,6GAA6G;QACtH,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,QAAQ;KACxB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE,4BAA4B;QACjC,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,6BAA6B;QACtC,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,QAAQ;KACxB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE,4BAA4B;QACjC,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,+DAA+D;QACxE,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,QAAQ;KACxB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE,4BAA4B;QACjC,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,6DAA6D;QACtE,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,QAAQ;KACxB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE,wBAAwB;QAC7B,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,6BAA6B;QACtC,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,QAAQ;KACxB;IACD;QACE,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,UAAU;QACjB,GAAG,EAAE,8BAA8B;QACnC,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,+CAA+C;QACxD,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,UAAU;KAC1B;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE,wBAAwB;QAC7B,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,wCAAwC;QACjD,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,QAAQ;KACxB;IACD;QACE,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,WAAW;QAClB,GAAG,EAAE,kCAAkC;QACvC,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,oHAAoH;QAC7H,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,WAAW;KAC3B;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO;QACd,mEAAmE;QACnE,GAAG,EAAE,8BAA8B;QACnC,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,sEAAsE;QAC/E,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,OAAO;KACvB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,YAAY;QACnB,qEAAqE;QACrE,+DAA+D;QAC/D,gDAAgD;QAChD,GAAG,EAAE,gCAAgC;QACrC,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,oGAAoG;QAC7G,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,YAAY;KAC5B;IACD;QACE,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,UAAU;QACjB,GAAG,EAAE,8BAA8B;QACnC,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,iDAAiD;QAC1D,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,UAAU;KAC1B;IACD;QACE,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,yBAAyB;QAC9B,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,qHAAqH;QAC9H,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,SAAS;KACzB;IACD;QACE,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,qCAAqC;QAC1C,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,kEAAkE;QAC3E,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,SAAS;KACzB;IACD;QACE,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,GAAG,EAAE,2BAA2B;QAChC,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,sDAAsD;QAC/D,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,MAAM;KACtB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE,uCAAuC;QAC5C,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,2DAA2D;QACpE,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,QAAQ;KACxB;IACD;QACE,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,6BAA6B;QAClC,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,8DAA8D;QACvE,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,SAAS;KACzB;IACD;QACE,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,KAAK;QACZ,GAAG,EAAE,yBAAyB;QAC9B,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,mEAAmE;QAC5E,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,KAAK;KACrB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,iHAAiH;QACjH,mHAAmH;QACnH,oHAAoH;QACpH,oHAAoH;QACpH,eAAe;QACf,GAAG,EAAE,+BAA+B;QACpC,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,iEAAiE;QAC1E,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,QAAQ;KACxB;IACD;QACE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,IAAI;QACX,+DAA+D;QAC/D,GAAG,EAAE,2BAA2B;QAChC,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,mDAAmD;QAC5D,UAAU,EAAE,YAAY;QACxB,aAAa,EAAE,OAAO;KACvB;CACF,CAAC"}

package/dist/registry/toolHints.d.ts

@@ -1,29 +0,0 @@
-/**
- * The title and the annotations (MCP `Tool.title`, `ToolAnnotations`) of OnlyMCP's own twenty-eight tools.
- *
- * One table for both ways in: the hosted endpoint sets the same values in its tool files (packages/api/src/mcp/tools,
- * pinned to this table by test/mcp-tool-annotations.spec.ts), and the stdio server lists straight from the copy of this
- * file in packages/mcp (scripts/sync-registry.mjs). A client that decides what to ask about by the hints must see the
- * same answer whichever way it connected. The last two entries, `connection_tool_schema` and `connection_call`, belong
- * to the hosted endpoint alone: they reach the tools of the account's gateway, which the stdio server does not have,
- * so it lists the other twenty-six.
- *
- * What the values say. `readOnlyHint: true` only for the fourteen tools that change nothing. The writers that replace
- * the whole file (`*_write`) are destructive and idempotent. `memory_move` and `connection_create` only add or move,
- * `connection_update` and `connection_tool_toggle` adjust and repeat harmlessly, every `*_delete` is destructive.
- * `connection_call` runs a tool of a foreign server, so it is not read-only, destructive (the callee is unknown) and
- * not idempotent. `openWorldHint` is false for all but `connection_create`, which probes a server of the caller's
- * choosing, and `connection_call`. The hints
- * are hints, not guarantees; the spec asks clients to weigh them by how far they trust the server, and this is that
- * server speaking about itself.
- */
-export interface ToolHint {
-    title: string;
-    annotations: {
-        readOnlyHint: boolean;
-        destructiveHint?: boolean;
-        idempotentHint?: boolean;
-        openWorldHint: boolean;
-    };
-}
-export declare const TOOL_HINTS: Readonly<Record<string, ToolHint>>;

package/dist/registry/toolHints.js

@@ -1,41 +0,0 @@
-const reads = (title) => ({ title, annotations: { readOnlyHint: true, openWorldHint: false } });
-const writes = (title, how) => ({
-    title,
-    annotations: {
-        readOnlyHint: false,
-        destructiveHint: how.destructive,
-        idempotentHint: how.idempotent,
-        openWorldHint: how.openWorld ?? false,
-    },
-});
-export const TOOL_HINTS = {
-    list_memory: reads('List memory files'),
-    memory_read: reads('Read a memory file'),
-    memory_write: writes('Write a memory file', { destructive: true, idempotent: true }),
-    memory_delete: writes('Delete a memory file', { destructive: true, idempotent: false }),
-    memory_search: reads('Search memory'),
-    memory_tree: reads('Show the memory tree'),
-    memory_move: writes('Move a memory file or folder', { destructive: false, idempotent: false }),
-    memory_links: reads('Show memory links'),
-    list_skills: reads('List skills'),
-    get_skill: reads('Load a skill'),
-    skill_write: writes('Write a skill', { destructive: true, idempotent: true }),
-    skill_delete: writes('Delete a skill', { destructive: true, idempotent: false }),
-    list_skill_files: reads('List skill files'),
-    get_skill_file: reads('Read a skill file'),
-    skill_file_write: writes('Write a skill file', { destructive: true, idempotent: true }),
-    skill_file_delete: writes('Delete a skill file', { destructive: true, idempotent: false }),
-    list_agents: reads('List agents'),
-    get_agent_definition: reads('Load an agent definition'),
-    agent_write: writes('Write an agent', { destructive: true, idempotent: true }),
-    agent_delete: writes('Delete an agent', { destructive: true, idempotent: false }),
-    list_connections: reads('List connections'),
-    connection_create: writes('Add a connection', { destructive: false, idempotent: false, openWorld: true }),
-    connection_update: writes('Update a connection', { destructive: false, idempotent: true }),
-    connection_delete: writes('Delete a connection', { destructive: true, idempotent: false }),
-    connection_tools: reads("List a connection's tools"),
-    connection_tool_toggle: writes('Switch a connection tool on or off', { destructive: false, idempotent: true }),
-    connection_tool_schema: reads("Show a connection tool's schema"),
-    connection_call: writes('Call a connection tool', { destructive: true, idempotent: false, openWorld: true }),
-};
-//# sourceMappingURL=toolHints.js.map

package/dist/registry/toolHints.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"toolHints.js","sourceRoot":"","sources":["../../src/registry/toolHints.ts"],"names":[],"mappings":"AA8BA,MAAM,KAAK,GAAG,CAAC,KAAa,EAAY,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AAElH,MAAM,MAAM,GAAG,CACb,KAAa,EACb,GAAuE,EAC7D,EAAE,CAAC,CAAC;IACd,KAAK;IACL,WAAW,EAAE;QACX,YAAY,EAAE,KAAK;QACnB,eAAe,EAAE,GAAG,CAAC,WAAW;QAChC,cAAc,EAAE,GAAG,CAAC,UAAU;QAC9B,aAAa,EAAE,GAAG,CAAC,SAAS,IAAI,KAAK;KACtC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAuC;IAC5D,WAAW,EAAE,KAAK,CAAC,mBAAmB,CAAC;IACvC,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC,qBAAqB,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACpF,aAAa,EAAE,MAAM,CAAC,sBAAsB,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACvF,aAAa,EAAE,KAAK,CAAC,eAAe,CAAC;IACrC,WAAW,EAAE,KAAK,CAAC,sBAAsB,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC,8BAA8B,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9F,YAAY,EAAE,KAAK,CAAC,mBAAmB,CAAC;IAExC,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC;IACjC,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC,eAAe,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC7E,YAAY,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAChF,gBAAgB,EAAE,KAAK,CAAC,kBAAkB,CAAC;IAC3C,cAAc,EAAE,KAAK,CAAC,mBAAmB,CAAC;IAC1C,gBAAgB,EAAE,MAAM,CAAC,oBAAoB,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACvF,iBAAiB,EAAE,MAAM,CAAC,qBAAqB,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAE1F,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC;IACjC,oBAAoB,EAAE,KAAK,CAAC,0BAA0B,CAAC;IACvD,WAAW,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9E,YAAY,EAAE,MAAM,CAAC,iBAAiB,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAEjF,gBAAgB,EAAE,KAAK,CAAC,kBAAkB,CAAC;IAC3C,iBAAiB,EAAE,MAAM,CAAC,kBAAkB,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACzG,iBAAiB,EAAE,MAAM,CAAC,qBAAqB,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC1F,iBAAiB,EAAE,MAAM,CAAC,qBAAqB,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC1F,gBAAgB,EAAE,KAAK,CAAC,2BAA2B,CAAC;IACpD,sBAAsB,EAAE,MAAM,CAAC,oCAAoC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9G,sBAAsB,EAAE,KAAK,CAAC,iCAAiC,CAAC;IAChE,eAAe,EAAE,MAAM,CAAC,wBAAwB,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;CAC7G,CAAC"}

package/dist/registry/types.d.ts

@@ -1,71 +0,0 @@
-export type ClientId = 'claude-code' | 'claude-app' | 'chatgpt' | 'codex' | 'antigravity' | 'gemini-app' | 'grok' | 'copilot-vscode' | 'cursor' | 'windsurf' | 'cline' | 'zed' | 'continue' | 'gitlab-duo' | 'opencode';
-export type ClientCategory = 'chat' | 'coding' | 'ide';
-/** How this client can reach OnlyMCP. Order in the array is preference order. */
-export type ConnectMethod = 'remote-oauth' | 'remote-header' | 'stdio';
-export type SnippetLanguage = 'bash' | 'json' | 'toml' | 'yaml' | 'text';
-export interface Snippet {
-    language: SnippetLanguage;
-    /** Never translated, never localised, never contains a placeholder path. */
-    text: string;
-    /** Where the snippet goes, if it is a file. */
-    path?: string;
-}
-/** Present only where `npx onlymcp install` can write the config itself. */
-export interface ClientInstall {
-    configPath: string;
-    format: 'json' | 'toml';
-    stubDir: string | null;
-}
-export interface ClientRecord {
-    id: ClientId;
-    /**
-     * Retired ids and spellings that still mean this client, so an old link (`?client=gemini-cli`) or an old command
-     * (`install --client gemini-cli`) lands on the successor. An alias is never another record's id (snippets.spec.ts).
-     */
-    aliases?: readonly string[];
-    name: string;
-    category: ClientCategory;
-    /**
-     * simple-icons slug, or a key of `FILE_MARKS` in `web/src/components/BrandMark.tsx` (an owner's official file, shown
-     * under their brand guidelines: `openai`, `antigravity`, `grok`), or null when no mark may be used.
-     */
-    brand: string | null;
-    methods: ConnectMethod[];
-    docsUrl: string;
-    /** ISO date on which the facts below were checked against docsUrl. */
-    verifiedOn: string;
-    /** Keys into CAVEATS (caveats.ts) for restrictions that must be stated; empty when there are none. */
-    caveats: string[];
-    install: ClientInstall | null;
-    /**
-     * The hosts a web client's OAuth redirect_uri points at, as its docs name them or, where they name none, as its own
-     * registrations on only-mcp.com show. The consent page shows this client's mark for a request whose code goes there:
-     * the redirect is used, not claimed. Absent where nothing is verified.
-     */
-    oauthRedirectHosts?: readonly string[];
-    /** Pure generator. Returns null when the remote-header method does not apply. */
-    remote(ctx: RemoteContext): Snippet[] | null;
-}
-export interface RemoteContext {
-    /** https://only-mcp.com/api/mcp */
-    endpoint: string;
-    /** Real token, or the literal placeholder 'omk_...'. */
-    token: string;
-    /** '~' on posix, '%USERPROFILE%' on windows. */
-    homePlaceholder?: string;
-}
-export interface ServerRecord {
-    id: string;
-    name: string;
-    /**
-     * simple-icons slug, or a key of `FILE_MARKS` in `web/src/components/BrandMark.tsx` (an owner's official file, shown
-     * under their brand guidelines: `openai`), or null when no mark may be used.
-     */
-    brand: string | null;
-    url: string;
-    auth: 'oauth' | 'bearer' | 'oauth-or-bearer' | 'none';
-    docsUrl: string;
-    verifiedOn: string;
-    /** 'github' -> github__create_issue */
-    suggestedSlug: string;
-}

package/dist/registry/types.js

@@ -1,6 +0,0 @@
-// Generated by scripts/sync-registry.mjs. Do not edit.
-// Types for the client and server registry. Zero runtime dependencies, no
-// Node API, no DOM, no React: this package is imported by the API (server),
-// the web app (browser) and, as a generated copy, the published CLI.
-export {};
-//# sourceMappingURL=types.js.map

package/dist/registry/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/registry/types.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,0EAA0E;AAC1E,4EAA4E;AAC5E,qEAAqE"}

package/dist/skillFilePath.d.ts

@@ -1 +0,0 @@
-export declare function isSafeSkillFilePath(path: string): boolean;

package/dist/skillFilePath.js

@@ -1,29 +0,0 @@
-// Client-seitige Kopie der Server-Regel (packages/api/src/skills/files.ts,
-// skillFilePath). Dasselbe Muster wie memoryPath.ts, und aus zwei Gruenden:
-//
-// Beim Schreiben (stubs.ts) ist es eine Sicherheitspruefung - aus einem Pfad,
-// den der Server geschickt hat, wird ein echter Schreibvorgang auf einer
-// echten Platte, und die muss auch dann halten, wenn jede andere Pruefung
-// versagt hat.
-//
-// Beim Planen (import/plan.ts) ist es Hoeflichkeit: der Bericht soll
-// "uebersprungen, ungueltiger Pfad" sagen koennen, statt dass jemand 307
-// Uploads zuschaut und einen 400 am Ende. Gemessen an einem echten Setup war
-// das genau eine Datei, `ui-styling/scripts/.coverage` - ein Segment darf
-// nicht mit einem Punkt beginnen.
-const SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-const MAX_SEGMENTS = 8;
-const MAX_LENGTH = 200;
-export function isSafeSkillFilePath(path) {
-    if (path.length === 0 || path.length > MAX_LENGTH)
-        return false;
-    // SKILL.md ist der Inhalt des Skills selbst und keine Begleitdatei. Der
-    // Server lehnt sie ab, damit es nicht zwei Orte fuer denselben Text gibt.
-    if (path === 'SKILL.md')
-        return false;
-    const parts = path.split('/');
-    if (parts.length > MAX_SEGMENTS)
-        return false;
-    return parts.every((seg) => SEGMENT.test(seg) && seg !== '..' && seg !== '.');
-}
-//# sourceMappingURL=skillFilePath.js.map

package/dist/skillFilePath.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"skillFilePath.js","sourceRoot":"","sources":["../src/skillFilePath.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,4EAA4E;AAC5E,EAAE;AACF,8EAA8E;AAC9E,yEAAyE;AACzE,0EAA0E;AAC1E,eAAe;AACf,EAAE;AACF,qEAAqE;AACrE,yEAAyE;AACzE,6EAA6E;AAC7E,0EAA0E;AAC1E,kCAAkC;AAClC,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAC/C,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,UAAU;QAAE,OAAO,KAAK,CAAC;IAChE,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,YAAY;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;AAChF,CAAC"}

package/dist/stubIgnore.d.ts

@@ -1,22 +0,0 @@
-/**
- * Says whether a skill or agent name is left out of the stubs.
- *
- * Every stub costs context in every session, because a client reads the
- * frontmatter of each one at start. Whoever keeps only some skills and agents
- * on disk lists the rest in the stub-ignore file, and `login`, `sync` and the
- * bridge write no stub for them, but take back the stubs they wrote earlier.
- * The rest stays reachable through get_skill and get_agent_definition. Before
- * the file existed, every login wrote all of them again: on 2026-10-19 that was
- * 205 agents and 15 skills the owner had moved out of ~/.claude.
- *
- * One pattern a line. `*` matches any run of characters, a line starting with
- * `#` is a comment, and a lone `*` means no stubs at all.
- */
-export type StubIgnore = (name: string) => boolean;
-export declare const ignoreNothing: StubIgnore;
-export declare function parseStubIgnore(text: string): StubIgnore;
-/**
- * A missing file leaves out nothing. Any other read error throws: writing every
- * stub then would be the very thing the file is there to stop.
- */
-export declare function readStubIgnore(path?: string): Promise<StubIgnore>;

package/dist/stubIgnore.js

@@ -1,29 +0,0 @@
-import { readFile } from 'node:fs/promises';
-import { stubIgnoreFile } from './paths.js';
-export const ignoreNothing = () => false;
-function escapeRegExp(text) {
-    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-export function parseStubIgnore(text) {
-    const patterns = text
-        .split(/\r?\n/)
-        .map((line) => line.trim())
-        .filter((line) => line !== '' && !line.startsWith('#'))
-        .map((line) => new RegExp(`^${line.split('*').map(escapeRegExp).join('.*')}$`));
-    return (name) => patterns.some((p) => p.test(name));
-}
-/**
- * A missing file leaves out nothing. Any other read error throws: writing every
- * stub then would be the very thing the file is there to stop.
- */
-export async function readStubIgnore(path = stubIgnoreFile()) {
-    try {
-        return parseStubIgnore(await readFile(path, 'utf8'));
-    }
-    catch (e) {
-        if (e.code === 'ENOENT')
-            return ignoreNothing;
-        throw e;
-    }
-}
-//# sourceMappingURL=stubIgnore.js.map

package/dist/stubIgnore.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"stubIgnore.js","sourceRoot":"","sources":["../src/stubIgnore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkB5C,MAAM,CAAC,MAAM,aAAa,GAAe,GAAG,EAAE,CAAC,KAAK,CAAC;AAErD,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,QAAQ,GAAG,IAAI;SAClB,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACtD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAI,GAAG,cAAc,EAAE;IAC1D,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,aAAa,CAAC;QACzE,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC"}

package/dist/stubs.d.ts

@@ -1,12 +0,0 @@
-import type { ApiClient } from './apiClient.js';
-import { type StubIgnore } from './stubIgnore.js';
-export declare function writeStubs(api: ApiClient, dir: string, opts?: {
-    ignore?: StubIgnore;
-}): Promise<{
-    skills: number;
-    agents: number;
-    files: number;
-    kept: string[];
-    ignored: string[];
-    removed: number;
-}>;