opedd-mcp 0.6.1 → 0.6.3

package/README.md

@@ -1,11 +1,38 @@
-# opedd-mcp
+<p align="center">
+  <img src="assets/opedd-logo.png" alt="Opedd" height="72">
+</p>
 
-Licensed content retrieval for AI agents via [MCP (Model Context Protocol)](https://modelcontextprotocol.io). The alternative to unlicensed web scraping for RAG pipelines, AI search, and LLM grounding.
+<h1 align="center">opedd-mcp</h1>
+
+<p align="center">
+  <strong>Licensed, rights-cleared content for AI agents</strong> — the alternative to unlicensed scraping for RAG, AI search, and LLM grounding.
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/opedd-mcp"><img src="https://img.shields.io/npm/v/opedd-mcp?color=4A26ED&label=npm" alt="npm"></a>
+  <a href="https://www.npmjs.com/package/opedd-mcp"><img src="https://img.shields.io/npm/dm/opedd-mcp?color=4A26ED&label=downloads" alt="downloads"></a>
+  <a href="https://registry.modelcontextprotocol.io/v0/servers?search=opedd"><img src="https://img.shields.io/badge/MCP%20Registry-com.opedd%2Fopedd--mcp-4A26ED" alt="MCP Registry"></a>
+  <a href="./LICENSE"><img src="https://img.shields.io/npm/l/opedd-mcp?color=4A26ED" alt="MIT"></a>
+</p>
+
+<p align="center">
+  <a href="cursor://anysphere.cursor-deeplink/mcp/install?name=opedd&config=eyJjb21tYW5kIjoibnB4IC15IG9wZWRkLW1jcCJ9"><img src="https://img.shields.io/badge/Add%20to-Cursor-000?logo=cursor" alt="Add to Cursor"></a>
+  <a href="https://insiders.vscode.dev/redirect/mcp/install?name=opedd&config=%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22opedd-mcp%22%5D%7D"><img src="https://img.shields.io/badge/Install%20in-VS%20Code-007ACC?logo=visualstudiocode" alt="Install in VS Code"></a>
+  <a href="https://opedd.com/for-ai-agents"><img src="https://img.shields.io/badge/Docs-opedd.com-111" alt="Docs"></a>
+</p>
 
 Lets AI assistants (Claude Desktop, Cursor, Windsurf, or any MCP-compatible host) discover, purchase, and verify content licenses autonomously — mid-conversation, without opening a browser. Every license is registered on-chain (Tempo blockchain) with cryptographic proof.
 
 **Unlike generic search APIs**, Opedd returns content with a verifiable license key — defensible under the EU AI Act and any copyright jurisdiction.
 
+## Quick start
+
+```bash
+npx opedd-mcp
+```
+
+Then add it to your MCP host (see [Claude Desktop / Cursor / Windsurf setup](#claude-desktop-setup) below). Discovery + verification tools work with no configuration; purchasing and content retrieval use optional API keys from [opedd.com](https://opedd.com).
+
 ## What it does
 
 Exposes up to 17 tools to any AI assistant (some are conditional on env vars):

package/dist/index.js

@@ -24,6 +24,10 @@ const BUYER_TOKEN = process.env.OPEDD_BUYER_TOKEN; // buyer API token (opedd_buy
 const ACCESS_KEY = process.env.OPEDD_ACCESS_KEY; // enterprise access key (ent_*); for /enterprise-license GET feed
 const BUYER_JWT = process.env.OPEDD_BUYER_JWT; // Supabase JWT; for /buyer-audit + /buyer-compliance-report
 // ─── HTTP helpers ─────────────────────────────────────────────────────────────
+// 30s cap (2026-07-10 hardening audit): without it a hung api.opedd.com
+// call hangs the agent's tool call indefinitely — an MCP server must fail
+// fast so the agent can recover.
+const FETCH_TIMEOUT_MS = 30_000;
 async function opeddFetch(path, options = {}) {
     const url = `${API_BASE}${path}`;
     const headers = {
@@ -33,13 +37,21 @@ async function opeddFetch(path, options = {}) {
         ...(PUB_BEARER ? { Authorization: `Bearer ${PUB_BEARER}` } : (API_KEY ? { "X-API-Key": API_KEY } : {})),
         ...(options.headers ?? {}),
     };
-    const res = await fetch(url, { ...options, headers });
-    const body = await res.json();
+    const res = await fetch(url, { ...options, headers, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+    // Check ok BEFORE parsing (2026-07-10 hardening): an HTML 502/504 from the
+    // proxy must surface as "HTTP 502", not a JSON SyntaxError.
     if (!res.ok) {
-        const msg = body?.error || body?.message || `HTTP ${res.status}`;
+        let msg = `HTTP ${res.status}`;
+        try {
+            const errBody = await res.json();
+            msg = errBody?.error || errBody?.message || msg;
+        }
+        catch {
+            // non-JSON error body — keep the HTTP-status default
+        }
         throw new Error(msg);
     }
-    return body;
+    return await res.json();
 }
 // Fetch an NDJSON endpoint and collect parsed lines into an array.
 // Last line is typically `{"_meta": {...}}`; surfaced as `meta` field on the
@@ -52,7 +64,7 @@ async function opeddFetchNdjson(path, options = {}) {
         ...(PUB_BEARER ? { Authorization: `Bearer ${PUB_BEARER}` } : (API_KEY ? { "X-API-Key": API_KEY } : {})),
         ...(options.headers ?? {}),
     };
-    const res = await fetch(url, { ...options, headers });
+    const res = await fetch(url, { ...options, headers, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
     if (!res.ok) {
         let msg = `HTTP ${res.status}`;
         try {

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "opedd-mcp",
-  "version": "0.6.1",
-  "description": "Licensed content for AI agents \u2014 discover, purchase, verify, and retrieve rights-cleared expert analysis with a verifiable license key per article, on-chain proof, and EU AI Act Article 53 attestation. The alternative to unlicensed scraping for RAG, AI search, and training pipelines.",
+  "version": "0.6.3",
+  "description": "Licensed, rights-cleared content for AI agents — verifiable license keys, on-chain proof, and EU AI Act attestation. The MCP alternative to unlicensed scraping for RAG and AI search.",
   "type": "module",
   "main": "dist/index.js",
-  "mcpName": "io.github.opedd/opedd-mcp",
+  "mcpName": "com.opedd/opedd-mcp",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Opedd/opedd-mcp.git"
@@ -56,4 +56,4 @@
   "files": [
     "dist"
   ]
-}
+}