prospectapis-mcp 0.2.2 → 0.2.4

package/CHANGELOG.md

@@ -6,6 +6,28 @@ All notable changes to `prospectapis-mcp` are documented here. The format follow
 
 ## [Unreleased]
 
+## [0.2.4] - unreleased
+
+### Fixed
+
+- Every tool has a human title ("Search Funding Rounds", "Delete Watchlist"), sent as both the tool's `title` and `annotations.title`; before, the title was the raw tool name.
+- `watchlist_delete` now says `destructiveHint: true` (it removes the watchlist and its delivery history), so a client asks before running it; it said `false`, like every other tool. The other writes stay non-destructive: they only add a research job, a watchlist, a test event or a report.
+- `idempotentHint` is set where it is true: the free reads and `watchlist_delete`. `funding_search` and `funding_get` stay `false`, because every call that returns records is billed again. `openWorldHint` stays `true` on every tool.
+- One factory, `annotationsFor()` in `src/tools.js`, builds these annotations for the npm server and the hosted MCP door alike. `test/annotations.test.js` checks every served tool (a title that is not the raw name and has no underscore, every `*_delete` tool destructive and not read-only) and plants each regression to prove the check fails on it.
+
+- README opening rewritten for the listings that copy it word for word (Glama, mcpservers.org, the MCP Registry, npm): one paragraph on what the server does and costs, then the install lines and the website, plus a three-question FAQ. No tool or behaviour change; 14 tools.
+- `package-lock.json` carries the package version again (it still said 0.2.2).
+- `test/readme-opening.test.js` checks the opening against the package name, its Website line against `server.json` `websiteUrl`, every tool count the README states against `src/tools.js`, the stated Node floor against `engines`, and one version across `package.json`, `server.json` and `package-lock.json`.
+- The README no longer says every funding record carries its announcement URL: some records come back without one, so the opening and the FAQ now say records carry the public announcement URL when there is one, and `test/readme-opening.test.js` fails on any sentence that promises a URL on every record.
+- `test/package-scripts.test.js` checks that every file an npm script runs exists in the checkout.
+
+## [0.2.3] - 2026-10-11
+
+### Added
+
+- `server.json` (the Official MCP Registry manifest) and the matching `mcpName` field in `package.json`, both `io.github.ProspectAPIs/prospectapis-mcp`, so the server can be listed on registry.modelcontextprotocol.io (which PulseMCP ingests). No tool or behaviour change.
+- `scripts/registry-drift.mjs` with `npm run check:registry-drift` and a `postpublish` hook, so every npm release also updates the registry entry and a drift between npm, `server.json` and the registry fails the check.
+
 ## [0.2.2] - 2026-10-03
 
 ### Changed

package/README.md

@@ -1,10 +1,12 @@
 # prospectapis-mcp
 
-MCP server for the ProspectAPIs funding data and research API. It gives an MCP client (Claude Desktop, Claude
-Code, Cursor and others) fourteen tools over `https://api.prospectapis.com`, one per customer endpoint (the
-liveness probe `GET /health` has none; `api_version` answers the same question). Five tools change state:
-`research_submit` (starts a paid research job), `watchlist_create`, `watchlist_test`, `watchlist_delete` and
-`feedback_send`; every other tool only reads.
+prospectapis-mcp is the MCP server for ProspectAPIs, built for sales teams and their AI agents in Claude Code, Claude Desktop, Cursor and other MCP clients. It gives your agent fourteen tools over the ProspectAPIs API: search funding rounds by date, round, amount, company, investor and country, get new matching rounds pushed to your webhook, and order a cited research brief on any company or person. Funding records carry the public announcement URL when there is one. Records cost $0.02 each after 100 free a month, a completed brief costs $0.15, and there are no seats, no subscription and no card to sign up. It needs Node.js 22 or later.
+
+Install (Claude Code): `claude mcp add prospectapis -e PROSPECTAPIS_API_KEY=pa_live_... -- npx -y prospectapis-mcp`
+
+Other clients: run `npx -y prospectapis-mcp` with `PROSPECTAPIS_API_KEY` from https://prospectapis.com
+
+Website: https://prospectapis.com/mcp
 
 | Tool | Endpoint | Cost |
 |---|---|---|
@@ -50,6 +52,14 @@ Client config (for example `claude_desktop_config.json`):
 
 Claude Code: `claude mcp add prospectapis -e PROSPECTAPIS_API_KEY=pa_live_... -- npx -y prospectapis-mcp`.
 
+## FAQ
+
+**Where does the funding data come from?** Records carry the public announcement URL when there is one.
+
+**What is free?** 100 funding records a month, any search that matches nothing, watchlist management, and the balance, pricing and version tools.
+
+**Which clients work?** Claude Code, Claude Desktop, Cursor and any client that reads an mcpServers config, through `npx -y prospectapis-mcp`.
+
 ## Develop
 
 ```bash

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "prospectapis-mcp",
-  "version": "0.2.2",
+  "version": "0.2.4",
+  "mcpName": "io.github.ProspectAPIs/prospectapis-mcp",
   "description": "MCP server for ProspectAPIs: search funding rounds, run paid prospect research briefs, manage funding watchlists, read your balance and the live price list.",
   "type": "module",
   "bin": {
@@ -25,7 +26,9 @@
     "start": "node src/index.js",
     "check": "node --check src/index.js && node --check src/server.js && node --check src/tools.js",
     "test": "node --test \"test/**/*.test.js\"",
-    "prepublishOnly": "npm test"
+    "prepublishOnly": "npm test && node scripts/prepublish-tenant-check.mjs",
+    "check:registry-drift": "node scripts/registry-drift.mjs",
+    "postpublish": "node scripts/registry-drift.mjs --publish"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",

package/src/server.js

@@ -5,7 +5,7 @@
 
 import { createRequire } from "node:module";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { TOOLS, buildUrl, buildPath, buildBody } from "./tools.js";
+import { TOOLS, buildUrl, buildPath, buildBody, annotationsFor } from "./tools.js";
 
 export const { version: VERSION } = createRequire(import.meta.url)("../package.json");
 
@@ -95,9 +95,10 @@ export function createServer({
     server.registerTool(
       tool.name,
       {
+        title: tool.title,
         description: tool.description,
         inputSchema: tool.shape,
-        annotations: { title: tool.name, readOnlyHint: !tool.write, destructiveHint: false, openWorldHint: true },
+        annotations: annotationsFor(tool),
       },
       (args) => callEndpoint(tool, args),
     );

package/src/tools.js

@@ -10,7 +10,13 @@
 //   - `write: true` marks a tool that changes state or spends credits
 //     (research_submit starts a paid job); the server turns `write` into MCP's
 //     readOnlyHint, so every other tool is read-only;
-//   - `auth: false` marks the tools the API serves without a key (pricing_get, api_version).
+//   - `auth: false` marks the tools the API serves without a key (pricing_get, api_version);
+//   - `title` is the human name a client shows instead of the raw tool name;
+//   - `idempotent: true` marks a tool whose repeat call with the same arguments changes nothing more: the free
+//     reads, and watchlist_delete (a second delete finds nothing to delete). funding_search and funding_get are
+//     read-only but NOT idempotent, because every call that returns records is billed again.
+// annotationsFor() below turns these fields into MCP tool annotations; the npm server and the hosted door
+// (apps/api/src/lib/mcp-door.js, through createServer) both register every tool with it, so they cannot drift.
 
 import { z } from "zod";
 
@@ -38,6 +44,7 @@ export const TOOLS = [
     name: "funding_search",
     method: "GET",
     path: "/v1/funding",
+    title: "Search Funding Rounds",
     write: false,
     format: { min_amount_usd: formatAmount, max_amount_usd: formatAmount },
     description:
@@ -64,6 +71,7 @@ export const TOOLS = [
     name: "funding_get",
     method: "GET",
     path: "/v1/funding/{id}",
+    title: "Get Funding Round",
     write: false,
     description: "Read one funding record by id. Costs $0.02 when found (free records are used first); a missing id is free.",
     shape: {
@@ -74,6 +82,7 @@ export const TOOLS = [
     name: "research_submit",
     method: "POST",
     path: "/v1/research",
+    title: "Start Prospect Research",
     write: true,
     body: true,
     description:
@@ -103,6 +112,8 @@ export const TOOLS = [
     name: "research_get",
     method: "GET",
     path: "/v1/research/{id}",
+    title: "Get Research Brief",
+    idempotent: true,
     write: false,
     description:
       "Read a research job by the `research_id` research_submit returned: `status` (queued, running, completed, failed), `input`, " +
@@ -118,6 +129,7 @@ export const TOOLS = [
     name: "watchlist_create",
     method: "POST",
     path: "/v1/watchlists",
+    title: "Create Funding Watchlist",
     body: true,
     write: true,
     description:
@@ -145,6 +157,8 @@ export const TOOLS = [
     name: "watchlist_list",
     method: "GET",
     path: "/v1/watchlists",
+    title: "List Watchlists",
+    idempotent: true,
     write: false,
     description: "Your funding-signal alerts (without their secrets). Free.",
     shape: {},
@@ -153,6 +167,8 @@ export const TOOLS = [
     name: "watchlist_get",
     method: "GET",
     path: "/v1/watchlists/{id}",
+    title: "Get Watchlist",
+    idempotent: true,
     write: false,
     description: "One funding-signal alert: its name, filters, webhook URL, whether it is active and why it was paused (never its secret). Free.",
     shape: { id: z.string().uuid().describe("The watchlist id.") },
@@ -161,6 +177,8 @@ export const TOOLS = [
     name: "watchlist_deliveries",
     method: "GET",
     path: "/v1/watchlists/{id}/deliveries",
+    title: "List Watchlist Deliveries",
+    idempotent: true,
     write: false,
     description: "The last 50 deliveries of one alert and their outcome (delivered, retry, failed, no_credit). Free.",
     shape: { id: z.string().uuid().describe("The watchlist id.") },
@@ -169,6 +187,7 @@ export const TOOLS = [
     name: "watchlist_test",
     method: "POST",
     path: "/v1/watchlists/{id}/test",
+    title: "Send Watchlist Test Event",
     body: true,
     write: true,
     description: "Send a signed sample event to the alert's webhook now, to build and verify the receiver. Free; 5 a minute.",
@@ -178,6 +197,8 @@ export const TOOLS = [
     name: "watchlist_delete",
     method: "DELETE",
     path: "/v1/watchlists/{id}",
+    title: "Delete Watchlist",
+    idempotent: true,
     write: true,
     description: "Delete a funding-signal alert and its delivery history. Free.",
     shape: { id: z.string().uuid().describe("The watchlist id.") },
@@ -186,6 +207,8 @@ export const TOOLS = [
     name: "account_balance",
     method: "GET",
     path: "/v1/account",
+    title: "Get Account Balance",
+    idempotent: true,
     write: false,
     description: "Your credit balance and the free records left this month. Free. Check it before a large paged search.",
     shape: {},
@@ -194,6 +217,7 @@ export const TOOLS = [
     name: "feedback_send",
     method: "POST",
     path: "/v1/feedback",
+    title: "Send Feedback",
     body: true,
     write: true,
     description:
@@ -212,6 +236,8 @@ export const TOOLS = [
     name: "pricing_get",
     method: "GET",
     path: "/pricing",
+    title: "Get Pricing",
+    idempotent: true,
     write: false,
     auth: false,
     description:
@@ -223,6 +249,8 @@ export const TOOLS = [
     name: "api_version",
     method: "GET",
     path: "/v1/version",
+    title: "Get API Version",
+    idempotent: true,
     write: false,
     auth: false,
     description: "The API's version and deployed build. Free, needs no key.",
@@ -270,3 +298,17 @@ export function buildBody(tool, args) {
   }
   return JSON.stringify(out);
 }
+
+// The one place a catalog entry becomes MCP tool annotations. A tool is destructive when it is a write whose
+// method is DELETE (watchlist_delete removes the watchlist and its delivery history); every other write only adds
+// (a research job, a watchlist, a test event, a report), so it is a write that is not destructive.
+export function annotationsFor(tool) {
+  const write = !!tool.write;
+  return {
+    title: tool.title,
+    readOnlyHint: !write,
+    destructiveHint: write && tool.method === "DELETE",
+    idempotentHint: !!tool.idempotent,
+    openWorldHint: true,
+  };
+}