vibes-plug 1.0.0 → 2.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (183) hide show
  1. package/.claude/rules/vibes-plug-core.md +32 -0
  2. package/.cursor/rules/vibes-plug-core.mdc +51 -0
  3. package/.cursorrules +42 -0
  4. package/AGENTS.md +96 -0
  5. package/BLUEPRINT.md +309 -125
  6. package/CHANGELOG.md +183 -1
  7. package/CLAUDE.md +70 -0
  8. package/LICENSE +1 -1
  9. package/README.md +641 -263
  10. package/index.js +19 -0
  11. package/package.json +61 -25
  12. package/plugin.json +24 -7
  13. package/scripts/generate_swarm_gif.py +295 -0
  14. package/scripts/install.js +201 -0
  15. package/skills/accessibility-testing-expert/SKILL.md +116 -0
  16. package/skills/ai-cost-token-optimizer/SKILL.md +82 -0
  17. package/skills/ai-evals-benchmark-expert/SKILL.md +188 -0
  18. package/skills/ai-llm-integration-expert/SKILL.md +147 -122
  19. package/skills/ai-media-generation-expert/SKILL.md +172 -0
  20. package/skills/ai-prompt-engineering-expert/SKILL.md +84 -0
  21. package/skills/angular-expert/SKILL.md +148 -0
  22. package/skills/api-design-expert/SKILL.md +316 -309
  23. package/skills/api-gateway-proxy-expert/SKILL.md +81 -0
  24. package/skills/app-analyzer-optimizer/SKILL.md +195 -188
  25. package/skills/apple-ecosystem-expert/SKILL.md +145 -0
  26. package/skills/{asisten_ramah → asisten-ramah}/SKILL.md +7 -1
  27. package/skills/astro-framework-expert/SKILL.md +200 -0
  28. package/skills/async-queue-temporal-expert/SKILL.md +240 -0
  29. package/skills/authentication-identity-expert/SKILL.md +279 -45
  30. package/skills/auto-doc-updater/SKILL.md +219 -203
  31. package/skills/autonomous-chaos-monkey/SKILL.md +63 -0
  32. package/skills/autonomous-red-teamer/SKILL.md +203 -0
  33. package/skills/autonomous-tdd-debugger/SKILL.md +71 -0
  34. package/skills/background-jobs-queue-expert/SKILL.md +235 -0
  35. package/skills/biome-linter-formatter-expert/SKILL.md +89 -0
  36. package/skills/blockchain-web3-expert/SKILL.md +115 -0
  37. package/skills/bootstrap-to-modern/SKILL.md +93 -86
  38. package/skills/brainstorming/SKILL.md +381 -353
  39. package/skills/browser-automation-expert/SKILL.md +222 -0
  40. package/skills/bun-runtime-expert/SKILL.md +7 -1
  41. package/skills/chatbot-messaging-expert/SKILL.md +114 -0
  42. package/skills/ci-cd-devops-architect/SKILL.md +81 -45
  43. package/skills/cloud-hosting-expert/SKILL.md +249 -243
  44. package/skills/coderabbit/SKILL.md +197 -191
  45. package/skills/compliance-gdpr-privacy-expert/SKILL.md +85 -0
  46. package/skills/cron-scheduler-expert/SKILL.md +304 -0
  47. package/skills/data-pipeline-etl-expert/SKILL.md +84 -0
  48. package/skills/data-telemetry-expert/SKILL.md +218 -212
  49. package/skills/data-visualization-expert/SKILL.md +154 -0
  50. package/skills/database-migration-versioning-expert/SKILL.md +90 -0
  51. package/skills/database-orm-expert/SKILL.md +303 -293
  52. package/skills/dependency-upgrade-migrator/SKILL.md +301 -0
  53. package/skills/design-system-architect/SKILL.md +278 -242
  54. package/skills/desktop-electron-expert/SKILL.md +128 -0
  55. package/skills/documentation-site-expert/SKILL.md +59 -0
  56. package/skills/doku-mcp-server/SKILL.md +257 -0
  57. package/skills/doku-payment-gateway/SKILL.md +233 -0
  58. package/skills/domain-driven-design-expert/SKILL.md +82 -0
  59. package/skills/e2e-testing-expert/SKILL.md +320 -314
  60. package/skills/ecommerce-expert/SKILL.md +87 -0
  61. package/skills/edge-serverless-db-expert/SKILL.md +99 -0
  62. package/skills/email-notification-expert/SKILL.md +368 -0
  63. package/skills/error-resilience-expert/SKILL.md +486 -0
  64. package/skills/event-driven-architect/SKILL.md +86 -80
  65. package/skills/feature-flag-analytics-expert/SKILL.md +66 -0
  66. package/skills/file-upload-media-expert/SKILL.md +437 -0
  67. package/skills/firebase-security-expert/SKILL.md +7 -1
  68. package/skills/form-validation-expert/SKILL.md +407 -0
  69. package/skills/fullstack-expert/SKILL.md +260 -201
  70. package/skills/fullstack-expert/references/api_design_guide.md +466 -466
  71. package/skills/fullstack-expert/references/multi_language_backend.md +528 -528
  72. package/skills/fullstack-expert/scripts/api_contract_validator.py +253 -253
  73. package/skills/fullstack-expert/scripts/architecture_analyzer.py +326 -326
  74. package/skills/gemini-agent-booster/SKILL.md +142 -104
  75. package/skills/geospatial-maps-expert/SKILL.md +80 -0
  76. package/skills/global-a11y-i18n-expert/SKILL.md +86 -80
  77. package/skills/glsl-shader-expert/SKILL.md +107 -0
  78. package/skills/go-programming-expert/SKILL.md +300 -294
  79. package/skills/graph-rag-knowledge-expert/SKILL.md +159 -0
  80. package/skills/graphql-apollo-expert/SKILL.md +114 -0
  81. package/skills/headless-cms-expert/SKILL.md +181 -0
  82. package/skills/hig/SKILL.md +193 -187
  83. package/skills/js-backend-expert/SKILL.md +218 -191
  84. package/skills/legacy-code-translator/SKILL.md +71 -0
  85. package/skills/local-slm-edge-ai-expert/SKILL.md +167 -0
  86. package/skills/logging-error-tracking-expert/SKILL.md +344 -0
  87. package/skills/mcp-client-orchestrator/SKILL.md +76 -0
  88. package/skills/mcp-server-architect/SKILL.md +226 -126
  89. package/skills/micro-frontend-architect/SKILL.md +112 -0
  90. package/skills/mobile-expo-expert/SKILL.md +191 -185
  91. package/skills/mobile-push-notification-expert/SKILL.md +71 -0
  92. package/skills/modern-css-native-expert/SKILL.md +189 -0
  93. package/skills/monday-design-aesthetic/SKILL.md +72 -66
  94. package/skills/monorepo-architect/SKILL.md +232 -226
  95. package/skills/mpa-orchestrator/SKILL.md +120 -101
  96. package/skills/multi-agent-orchestration/SKILL.md +173 -153
  97. package/skills/multiple-entry-points/SKILL.md +91 -55
  98. package/skills/mvc-expert/SKILL.md +237 -231
  99. package/skills/n8n-automation-expert/SKILL.md +89 -0
  100. package/skills/nextjs-app-router-expert/SKILL.md +148 -0
  101. package/skills/openapi-swagger-codegen-expert/SKILL.md +67 -0
  102. package/skills/payment-gateway-expert/SKILL.md +129 -45
  103. package/skills/pdf-document-generation-expert/SKILL.md +91 -0
  104. package/skills/performance-web-vitals/SKILL.md +337 -331
  105. package/skills/post-quantum-crypto-migrator/SKILL.md +57 -0
  106. package/skills/prd-architect/SKILL.md +206 -190
  107. package/skills/proactive-background-watcher/SKILL.md +68 -0
  108. package/skills/production-ready-hardener/PRODUCTION_READINESS_REPORT.md +67 -0
  109. package/skills/production-ready-hardener/SKILL.md +461 -468
  110. package/skills/production-ready-hardener/references/production_checklist.md +161 -161
  111. package/skills/production-ready-hardener/scripts/production_readiness_scanner.py +881 -875
  112. package/skills/project-context-mapper/SKILL.md +85 -0
  113. package/skills/pwa-offline-first-expert/SKILL.md +185 -0
  114. package/skills/python-programming-expert/SKILL.md +407 -270
  115. package/skills/rate-limit-abuse-prevention/SKILL.md +377 -0
  116. package/skills/realtime-collaboration-expert/SKILL.md +99 -45
  117. package/skills/rich-text-editor-expert/SKILL.md +177 -0
  118. package/skills/rust-programming-expert/SKILL.md +240 -234
  119. package/skills/saas-billing/SKILL.md +382 -376
  120. package/skills/saas-multi-tenant/SKILL.md +256 -236
  121. package/skills/saas-mvp-launcher/SKILL.md +30 -1
  122. package/skills/saas-transformer/SKILL.md +499 -445
  123. package/skills/saas-transformer/references/billing_integration_guide.md +401 -401
  124. package/skills/saas-transformer/references/feature_gating_patterns.md +137 -137
  125. package/skills/saas-transformer/references/saas_transformation_checklist.md +121 -121
  126. package/skills/saas-transformer/scripts/saas_transformation_scanner.py +39 -29
  127. package/skills/scalability-clean-code/SKILL.md +234 -228
  128. package/skills/search-engine-expert/SKILL.md +89 -0
  129. package/skills/secure-fuzz-testing/SKILL.md +7 -1
  130. package/skills/self-evolving-memory-graph/SKILL.md +91 -0
  131. package/skills/self-healing-cloud-orchestrator/SKILL.md +57 -0
  132. package/skills/senior-frontend/SKILL.md +85 -105
  133. package/skills/seo/SKILL.md +258 -224
  134. package/skills/session-context-loader/SKILL.md +83 -0
  135. package/skills/session-handoff-resume/SKILL.md +163 -157
  136. package/skills/{skill_baru → skill-baru}/SKILL.md +177 -146
  137. package/skills/solidjs-expert/SKILL.md +80 -0
  138. package/skills/spa-orchestrator/SKILL.md +306 -287
  139. package/skills/sse-websocket-streaming-expert/SKILL.md +93 -0
  140. package/skills/state-management-expert/SKILL.md +277 -271
  141. package/skills/supabase-migration/SKILL.md +47 -1
  142. package/skills/supabase-security-expert/SKILL.md +248 -242
  143. package/skills/svelte-sveltekit-expert/SKILL.md +91 -0
  144. package/skills/svg-animation-motion-expert/SKILL.md +115 -0
  145. package/skills/tailwind-expert/SKILL.md +139 -187
  146. package/skills/tanstack-query-expert/SKILL.md +204 -198
  147. package/skills/tauri-expert/SKILL.md +7 -1
  148. package/skills/token-saver/SKILL.md +118 -110
  149. package/skills/typescript-expert/SKILL.md +329 -278
  150. package/skills/ui-components-expert/SKILL.md +166 -63
  151. package/skills/ui-ux-pro-max/SKILL.md +221 -200
  152. package/skills/vector-db-rag-expert/SKILL.md +208 -0
  153. package/skills/vibe-code-gardener/SKILL.md +180 -172
  154. package/skills/visual-qa-vision-agent/SKILL.md +71 -0
  155. package/skills/voice-ai-realtime-agent/SKILL.md +202 -0
  156. package/skills/vue-frontend-expert/SKILL.md +132 -0
  157. package/skills/wasm-edge-computing-expert/SKILL.md +97 -0
  158. package/skills/web-3d-graphics-expert/SKILL.md +137 -0
  159. package/skills/web-game-engine-expert/SKILL.md +102 -0
  160. package/skills/web-scraper/SKILL.md +98 -146
  161. package/skills/website-design-cloner/SKILL.md +180 -0
  162. package/skills/webxr-ar-vr-expert/SKILL.md +123 -0
  163. package/skills/wordpress-headless-expert/SKILL.md +144 -0
  164. package/skills/zero-to-prod-orchestrator/SKILL.md +231 -180
  165. package/skills/zero-trust-secret-vault/SKILL.md +88 -0
  166. package/.github/ISSUE_TEMPLATE/feature_request.md +0 -20
  167. package/CONTRIBUTING.md +0 -199
  168. package/SECURITY.md +0 -21
  169. package/banner.png +0 -0
  170. package/skills/senior-fullstack/SKILL.md +0 -167
  171. package/skills/senior-fullstack/references/architecture_patterns.md +0 -160
  172. package/skills/senior-fullstack/references/development_workflows.md +0 -222
  173. package/skills/senior-fullstack/references/tech_stack_guide.md +0 -190
  174. package/skills/senior-fullstack/scripts/code_quality_analyzer.py +0 -114
  175. package/skills/senior-fullstack/scripts/fullstack_scaffolder.py +0 -114
  176. package/skills/senior-fullstack/scripts/project_scaffolder.py +0 -114
  177. package/skills/seo-aeo-landing-page-writer/SKILL.md +0 -97
  178. package/skills/seo-geo/SKILL.md +0 -188
  179. package/skills/ui-ux-pro-max/scripts/__pycache__/core.cpython-310.pyc +0 -0
  180. package/skills/ui-ux-pro-max/scripts/__pycache__/core.cpython-312.pyc +0 -0
  181. package/skills/ui-ux-pro-max/scripts/__pycache__/design_system.cpython-310.pyc +0 -0
  182. package/skills/ui-ux-pro-max/scripts/__pycache__/design_system.cpython-312.pyc +0 -0
  183. package/skills/ui_ux_expert/SKILL.md +0 -114
@@ -1,10 +1,10 @@
1
1
  ---
2
2
  name: mcp-server-architect
3
- description: "Expert guide for designing, building, and security-hardening Model Context Protocol (MCP) servers and tool integrations in TypeScript, Python, and Go / Panduan ahli merancang, membangun, dan mengamankan server Model Context Protocol (MCP) dan integrasi tool dalam TypeScript, Python, dan Go."
3
+ description: "Ultimate guide for designing, building, and security-hardening modern AI Tools/Bots via Model Context Protocol (MCP v1.x) in TypeScript and Python / Panduan utama merancang, membangun, dan mengamankan AI Tools/Bots modern melalui Model Context Protocol (MCP) dalam TypeScript dan Python."
4
4
  author: "Roedy Rustam"
5
5
  ---
6
6
 
7
- # MCP Server Architect (v1.9+ Edition)
7
+ # MCP Server Architect (Modern AI Tools & Agentic Protocol)
8
8
 
9
9
  [English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
10
10
 
@@ -13,182 +13,282 @@ author: "Roedy Rustam"
13
13
  <a name="english"></a>
14
14
  ## English
15
15
 
16
+ ### Orchestration & Integration
17
+ Connects and orchestrates with relevant domain skills: `ai-llm-integration-expert` for core LLM routing and RAG pipelines, `mcp-client-orchestrator` for agent client consumption, and `doku-mcp-server` for payments integration examples. Ensure cohesive execution when spawning subagents.
18
+
16
19
  ### Description
17
- Expert guide for designing, building, and security-hardening **Model Context Protocol (MCP)** servers and client integrations. Covers MCP v1.9+ specification (including the new Streamable HTTP transport), tool/resource/prompt design, Zod validation, OAuth 2.1 authorization, and multi-server orchestration patterns for production AI applications.
20
+ Ultimate architectural guide for engineering high-performance, production-ready AI Tools/Bots via the **Model Context Protocol (MCP v1.x)**. Enforces the use of `FastMCP` (Python) and `@modelcontextprotocol/sdk` (TypeScript). Mandates strict security guardrails, schema validation, stateful resource streaming, and support for both Standard Stdio and Streamable HTTP / Server-Sent Events (SSE) transports.
18
21
 
19
22
  ### Trigger Conditions
20
23
  - Building an MCP server to expose tools, resources, or prompt templates to AI agents.
21
- - Integrating third-party APIs or databases as MCP tools for LLM consumption.
22
- - Implementing MCP client logic in an AI agent or chatbot.
23
- - Securing MCP servers with OAuth 2.1 and permission scoping.
24
- - Deploying MCP servers to edge/serverless environments.
25
-
26
- ### MCP v1.9+ Specification Overview
27
-
28
- MCP standardizes how AI models interact with external tools and data. The 2026 specification (v1.9) introduces:
24
+ - Integrating backend APIs, file systems, or databases as MCP agent tools.
25
+ - Implementing stateful, real-time MCP servers (resource subscriptions, log tailing, live metrics).
26
+ - Securing and auditing MCP servers exposing sensitive financial or production data.
29
27
 
30
- | Feature | Description |
31
- |---|---|
32
- | **Streamable HTTP** | New bidirectional transport via HTTP streaming — replaces SSE for cloud deployments |
33
- | **stdio** | Original transport for local/CLI tools — still recommended for local MCP |
34
- | **OAuth 2.1** | Standard authorization flow for MCP servers requiring user consent |
35
- | **Tool Annotations** | `readOnlyHint`, `destructiveHint`, `idempotentHint` for safer agent decisions |
36
- | **Audio Content** | Support for audio data in tool responses |
37
- | **Resource Links** | Resources can now link to external URIs |
28
+ ---
38
29
 
39
- ### Core MCP Concepts
30
+ ### SDK Selection (Mandatory Standard)
31
+ 1. **Python**: `FastMCP` (FastAPI-like high-level DX for MCP tools, resources, and prompt templates).
32
+ 2. **TypeScript**: `@modelcontextprotocol/sdk` (official SDK using the `McpServer` high-level abstraction with `zod`).
40
33
 
41
- | Primitive | What It Is | Example |
42
- |---|---|---|
43
- | **Tool** | Executable function the LLM can call | `search_database`, `send_email` |
44
- | **Resource** | Read-only data the LLM can read | File contents, DB records |
45
- | **Prompt** | Reusable prompt templates | `code_review_prompt` |
46
- | **Sampling** | Server requests LLM completion | Agent asks LLM to classify |
34
+ ---
47
35
 
48
- ### Building an MCP Server (TypeScript)
36
+ ### Production Implementation Recipes
49
37
 
50
- #### 1. Setup with `@modelcontextprotocol/sdk`
38
+ #### Recipe 1: Production TypeScript MCP Server (Streamable HTTP / SSE)
51
39
  ```typescript
52
- import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
53
- import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
40
+ import { McpServer, ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
41
+ import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
42
+ import express from 'express';
54
43
  import { z } from 'zod';
55
44
 
45
+ // Initialize the high-level MCP Server
56
46
  const server = new McpServer({
57
- name: 'my-api-server',
47
+ name: 'enterprise-analytics-mcp',
58
48
  version: '1.0.0',
59
49
  });
60
- ```
61
50
 
62
- #### 2. Define Tools with Zod Validation
63
- ```typescript
51
+ // Register a type-safe Tool with Zod validation
64
52
  server.tool(
65
- 'search_products',
66
- 'Search the product catalog by query and category',
67
- {
68
- query: z.string().min(1).describe('Search query string'),
69
- category: z.enum(['electronics', 'clothing', 'books']).optional(),
70
- limit: z.number().int().min(1).max(50).default(10),
71
- },
53
+ 'calculate_metrics',
54
+ 'Calculates business analytics metrics across timeframes',
72
55
  {
73
- readOnlyHint: true, // v1.9 annotation: this tool does not modify state
74
- idempotentHint: true, // safe to call multiple times
56
+ metricName: z.enum(['arr', 'churn', 'cac', 'ltv']).describe('The metric to compute'),
57
+ quarter: z.string().regex(/^Q[1-4]-202[0-9]$/).describe('Target quarter, e.g., Q1-2026'),
75
58
  },
76
- async ({ query, category, limit }) => {
77
- const results = await productDB.search({ query, category, limit });
59
+ async ({ metricName, quarter }) => {
60
+ // Implement business logic with database access
61
+ const mockData = { arr: '$2.4M', churn: '1.2%', cac: '$450', ltv: '$9,200' };
78
62
  return {
79
- content: [{ type: 'text', text: JSON.stringify(results, null, 2) }],
63
+ content: [
64
+ {
65
+ type: 'text',
66
+ text: JSON.stringify({ metric: metricName, quarter, value: mockData[metricName] }),
67
+ },
68
+ ],
80
69
  };
81
70
  }
82
71
  );
83
- ```
84
72
 
85
- #### 3. Expose Resources
86
- ```typescript
73
+ // Register a Resource Template with dynamic URI
87
74
  server.resource(
88
- 'company-docs',
89
- 'docs://{path}',
90
- { mimeType: 'text/markdown' },
91
- async (uri) => {
92
- const path = uri.pathname;
93
- const content = await fs.readFile(`./docs${path}`, 'utf-8');
94
- return { contents: [{ uri: uri.href, mimeType: 'text/markdown', text: content }] };
75
+ 'system_health',
76
+ new ResourceTemplate('system://health/{service}', { list: undefined }),
77
+ async (uri, { service }) => {
78
+ return {
79
+ contents: [
80
+ {
81
+ uri: uri.href,
82
+ text: JSON.stringify({ service, status: 'HEALTHY', latencyMs: 14, timestamp: new Date().toISOString() }),
83
+ },
84
+ ],
85
+ };
95
86
  }
96
87
  );
97
- ```
98
-
99
- #### 4. Streamable HTTP Transport (v1.9 — Production Deployment)
100
- ```typescript
101
- import express from 'express';
102
88
 
89
+ // Expose via Express with SSE Transport
103
90
  const app = express();
104
- app.use(express.json());
91
+ let transport: SSEServerTransport | null = null;
105
92
 
106
- app.all('/mcp', async (req, res) => {
107
- const transport = new StreamableHTTPServerTransport({
108
- sessionIdGenerator: () => crypto.randomUUID(),
109
- });
93
+ app.get('/sse', async (req, res) => {
94
+ transport = new SSEServerTransport('/messages', res);
110
95
  await server.connect(transport);
111
- await transport.handleRequest(req, res, req.body);
112
96
  });
113
97
 
114
- app.listen(3000, () => console.log('MCP Server running on :3000'));
115
- ```
116
-
117
- #### 5. OAuth 2.1 Authorization (Secure MCP)
118
- For MCP servers requiring user consent (e.g., accessing user's GitHub repos):
119
- ```typescript
120
- import { ProxyOAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/providers/proxyOAuth.js';
121
-
122
- const authProvider = new ProxyOAuthServerProvider({
123
- endpoints: {
124
- authorizationUrl: 'https://github.com/login/oauth/authorize',
125
- tokenUrl: 'https://github.com/login/oauth/access_token',
126
- },
127
- clientId: process.env.GITHUB_CLIENT_ID!,
128
- clientSecret: process.env.GITHUB_CLIENT_SECRET!,
129
- scopes: ['repo', 'read:user'],
98
+ app.post('/messages', async (req, res) => {
99
+ if (transport) {
100
+ await transport.handlePostMessage(req, res);
101
+ } else {
102
+ res.status(400).send('Transport not established');
103
+ }
130
104
  });
131
105
 
132
- server.setAuthProvider(authProvider);
106
+ app.listen(3001, () => {
107
+ console.log('MCP Server listening on http://localhost:3001/sse');
108
+ });
133
109
  ```
134
110
 
135
- ### Security Hardening
136
-
137
- - **Validate ALL inputs**: Every tool parameter must be validated with Zod before execution. Never trust LLM-generated inputs directly.
138
- - **Principle of Least Privilege**: Each tool should only request the minimum permissions needed.
139
- - **Rate Limiting**: Implement per-session rate limits to prevent prompt injection loops.
140
- - **Sanitize Outputs**: Never return raw database records with sensitive fields (passwords, API keys). Always filter/select only what's needed.
141
- - **Audit Logging**: Log every tool call with session ID, tool name, parameters, and result status.
142
- - **Tool Annotations**: Use `destructiveHint: true` for tools that modify or delete data — agents should ask for human confirmation before calling these.
143
-
144
- ### Multi-Server Orchestration
145
- When building AI apps with multiple MCP servers:
146
- ```typescript
147
- // Client connecting to multiple MCP servers
148
- const client = new McpClient({ name: 'my-agent', version: '1.0.0' });
111
+ #### Recipe 2: Production FastMCP Server (Python)
112
+ ```python
113
+ from fastmcp import FastMCP, Context
114
+ from pydantic import BaseModel, Field
115
+ from typing import Literal
116
+
117
+ mcp = FastMCP("enterprise-vault-mcp", dependencies=["pydantic"])
118
+
119
+ class QueryParams(BaseModel):
120
+ account_id: str = Field(..., description="UUID of customer account")
121
+ status_filter: Literal["active", "suspended", "all"] = Field("active", description="Status filter")
122
+
123
+ @mcp.tool(name="fetch_account_summary", description="Retrieves account telemetry and balance")
124
+ async def fetch_account_summary(params: QueryParams, ctx: Context) -> str:
125
+ ctx.info(f"Auditing request for account: {params.account_id}")
126
+
127
+ # Secure business logic with RLS validation
128
+ result = {
129
+ "account_id": params.account_id,
130
+ "balance_usd": 125430.50,
131
+ "tier": "enterprise",
132
+ "status": params.status_filter
133
+ }
134
+ return str(result)
135
+
136
+ @mcp.resource("config://app-settings")
137
+ def get_app_settings() -> str:
138
+ """Provides application configuration context to the agent."""
139
+ return '{"environment": "production", "rate_limit_rpm": 600, "region": "ap-southeast-1"}'
140
+
141
+ if __name__ == "__main__":
142
+ # Runs standard Stdio transport or streamable HTTP
143
+ mcp.run(transport="stdio")
144
+ ```
149
145
 
150
- // Connect to multiple specialized servers
151
- await client.connect(new StdioTransport({ command: 'node', args: ['file-server.js'] }));
152
- await client.connect(new StreamableHTTPTransport({ url: 'https://api.mydb.com/mcp' }));
146
+ ---
153
147
 
154
- // List all available tools across servers
155
- const { tools } = await client.listTools();
156
- ```
148
+ ### Security & Operational Guardrails
149
+ 1. **OAuth 2.1 & Bearer Authentication**: Bind session tokens to transport connections. Validate claims before executing any tool logic.
150
+ 2. **Schema Strictness**: Never use untyped payloads. Every argument must have explicit types, range constraints, and descriptions to guide LLM tool-calling accuracy.
151
+ 3. **Row-Level Security (RLS)**: Enforce tenant and user context propagation to the database layer.
152
+ 4. **Circuit Breakers & Rate Limits**: Cap consecutive tool executions per agent turn to prevent endless agentic recursive loops.
153
+ 5. **Idempotency**: All destructive or state-mutating tools must require an `idempotency_key` argument.
157
154
 
158
155
  ---
159
156
 
160
157
  <a name="bahasa-indonesia"></a>
161
158
  ## Bahasa Indonesia
162
159
 
160
+ ### Integrasi Orkestrasi
161
+ Terhubung dan mengorkestrasi dengan skill domain relevan: `ai-llm-integration-expert` untuk perutean LLM inti dan pipeline RAG, `mcp-client-orchestrator` untuk konsumsi klien agen, serta `doku-mcp-server` untuk contoh integrasi pembayaran.
162
+
163
163
  ### Deskripsi
164
- Panduan ahli untuk merancang, membangun, dan mengamankan server **Model Context Protocol (MCP)** dan integrasi klien. Mencakup spesifikasi MCP v1.9+ (termasuk transport Streamable HTTP baru), desain tool/resource/prompt, validasi Zod, otorisasi OAuth 2.1, dan pola orkestrasi multi-server untuk aplikasi AI produksi.
164
+ Panduan arsitektur utama untuk membangun AI Tools/Bots modern dan siap produksi via **Model Context Protocol (MCP v1.x)**. Mewajibkan penggunaan `FastMCP` (Python) dan `@modelcontextprotocol/sdk` (TypeScript). Menerapkan pengamanan ketat, validasi skema, streaming resource stateful, serta dukungan transport Standar Stdio maupun Streamable HTTP / SSE.
165
165
 
166
166
  ### Kondisi Pemicu
167
- - Membangun MCP server untuk mengekspos tool, resource, atau prompt template ke agen AI.
168
- - Mengintegrasikan API pihak ketiga atau database sebagai MCP tool untuk konsumsi LLM.
169
- - Mengimplementasikan logika klien MCP dalam agen AI atau chatbot.
170
- - Mengamankan MCP server dengan OAuth 2.1 dan pembatasan izin.
171
- - Men-deploy MCP server ke lingkungan edge/serverless.
167
+ - Membangun server MCP untuk mengekspos alat (*tools*), resource, atau template prompt ke agen AI.
168
+ - Mengintegrasikan API backend, sistem file, atau database sebagai alat agen AI.
169
+ - Mengimplementasikan server MCP stateful dan real-time (langganan resource, tailing log, metrik langsung).
170
+ - Mengamankan server MCP yang mengekspos data finansial atau produksi yang sensitif.
171
+
172
+ ---
173
+
174
+ ### Standar Pemilihan SDK (Wajib)
175
+ 1. **Python**: `FastMCP` (pengalaman developer tingkat tinggi ala FastAPI untuk tools, resource, dan template prompt).
176
+ 2. **TypeScript**: `@modelcontextprotocol/sdk` (SDK resmi menggunakan abstraksi `McpServer` dengan `zod`).
172
177
 
173
- ### Ringkasan Spesifikasi MCP v1.9+
178
+ ---
174
179
 
175
- MCP menstandarisasi cara model AI berinteraksi dengan tool dan data eksternal. Spesifikasi 2026 (v1.9) memperkenalkan:
176
- - **Streamable HTTP**: Transport dua arah baru via HTTP streaming — menggantikan SSE untuk deployment cloud.
177
- - **Tool Annotations**: `readOnlyHint`, `destructiveHint`, `idempotentHint` untuk keputusan agen yang lebih aman.
178
- - **OAuth 2.1**: Alur otorisasi standar untuk MCP server yang memerlukan izin pengguna.
180
+ ### Resep Implementasi Produksi
179
181
 
180
- ### Membangun MCP Server (TypeScript)
182
+ #### Resep 1: Server MCP TypeScript Produksi (Streamable HTTP / SSE)
183
+ ```typescript
184
+ import { McpServer, ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
185
+ import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
186
+ import express from 'express';
187
+ import { z } from 'zod';
181
188
 
182
- Gunakan `@modelcontextprotocol/sdk` untuk TypeScript. Definisikan tool dengan validasi Zod yang ketat, tambahkan anotasi v1.9 (`readOnlyHint`, `destructiveHint`), dan gunakan Streamable HTTP transport untuk deployment cloud produksi.
189
+ const server = new McpServer({
190
+ name: 'enterprise-analytics-mcp',
191
+ version: '1.0.0',
192
+ });
193
+
194
+ // Pendaftaran Tool dengan validasi ketat Zod
195
+ server.tool(
196
+ 'calculate_metrics',
197
+ 'Menghitung metrik analitik bisnis untuk kuartal tertentu',
198
+ {
199
+ metricName: z.enum(['arr', 'churn', 'cac', 'ltv']).describe('Metrik yang ingin dihitung'),
200
+ quarter: z.string().regex(/^Q[1-4]-202[0-9]$/).describe('Target kuartal, misal: Q1-2026'),
201
+ },
202
+ async ({ metricName, quarter }) => {
203
+ const data = { arr: '$2.4M', churn: '1.2%', cac: '$450', ltv: '$9,200' };
204
+ return {
205
+ content: [
206
+ {
207
+ type: 'text',
208
+ text: JSON.stringify({ metrik: metricName, kuartal: quarter, nilai: data[metricName] }),
209
+ },
210
+ ],
211
+ };
212
+ }
213
+ );
183
214
 
184
- ### Keamanan MCP
215
+ // Pendaftaran Template Resource dengan URI Dinamis
216
+ server.resource(
217
+ 'system_health',
218
+ new ResourceTemplate('system://health/{service}', { list: undefined }),
219
+ async (uri, { service }) => {
220
+ return {
221
+ contents: [
222
+ {
223
+ uri: uri.href,
224
+ text: JSON.stringify({ layanan: service, status: 'HEALTHY', latensiMs: 14, waktu: new Date().toISOString() }),
225
+ },
226
+ ],
227
+ };
228
+ }
229
+ );
230
+
231
+ const app = express();
232
+ let transport: SSEServerTransport | null = null;
233
+
234
+ app.get('/sse', async (req, res) => {
235
+ transport = new SSEServerTransport('/messages', res);
236
+ await server.connect(transport);
237
+ });
238
+
239
+ app.post('/messages', async (req, res) => {
240
+ if (transport) {
241
+ await transport.handlePostMessage(req, res);
242
+ } else {
243
+ res.status(400).send('Transport belum terhubung');
244
+ }
245
+ });
246
+
247
+ app.listen(3001, () => {
248
+ console.log('Server MCP berjalan pada http://localhost:3001/sse');
249
+ });
250
+ ```
251
+
252
+ #### Resep 2: Server FastMCP Produksi (Python)
253
+ ```python
254
+ from fastmcp import FastMCP, Context
255
+ from pydantic import BaseModel, Field
256
+ from typing import Literal
257
+
258
+ mcp = FastMCP("enterprise-vault-mcp", dependencies=["pydantic"])
259
+
260
+ class ParameterAkun(BaseModel):
261
+ account_id: str = Field(..., description="UUID akun pengguna")
262
+ status_filter: Literal["active", "suspended", "all"] = Field("active", description="Filter status")
263
+
264
+ @mcp.tool(name="ambil_ringkasan_akun", description="Mengambil telemetri dan saldo akun")
265
+ async def ambil_ringkasan_akun(params: ParameterAkun, ctx: Context) -> str:
266
+ ctx.info(f"Memproses permintaan untuk akun: {params.account_id}")
267
+ hasil = {
268
+ "account_id": params.account_id,
269
+ "saldo_usd": 125430.50,
270
+ "tier": "enterprise",
271
+ "status": params.status_filter
272
+ }
273
+ return str(hasil)
274
+
275
+ @mcp.resource("config://app-settings")
276
+ def ambil_pengaturan_aplikasi() -> str:
277
+ """Menyediakan konteks konfigurasi aplikasi ke agen AI."""
278
+ return '{"environment": "production", "rate_limit_rpm": 600, "region": "ap-southeast-1"}'
279
+
280
+ if __name__ == "__main__":
281
+ mcp.run(transport="stdio")
282
+ ```
283
+
284
+ ---
185
285
 
186
- - **Validasi SEMUA input**: Setiap parameter tool harus divalidasi dengan Zod sebelum eksekusi.
187
- - **Prinsip Least Privilege**: Setiap tool hanya boleh meminta izin minimum yang diperlukan.
188
- - **Rate Limiting**: Batasi panggilan per sesi untuk mencegah loop prompt injection.
189
- - **Sanitasi Output**: Jangan pernah mengembalikan field sensitif (password, API key).
190
- - **Audit Logging**: Catat setiap panggilan tool dengan session ID, nama tool, parameter, dan status hasil.
191
- - **Anotasi Tool**: Gunakan `destructiveHint: true` untuk tool yang memodifikasi/menghapus data agen harus meminta konfirmasi manusia sebelum memanggilnya.
286
+ ### Keamanan & Batasan Operasional
287
+ 1. **Otentikasi OAuth 2.1 & Bearer**: Ikat token sesi ke koneksi transport. Validasi hak akses sebelum mengeksekusi logika alat.
288
+ 2. **Validasi Skema Ketat**: Hindari penggunaan parameter tanpa tipe data yang jelas. Setiap argumen wajib memiliki tipe data, batas nilai, dan deskripsi.
289
+ 3. **Row-Level Security (RLS)**: Teruskan identitas pengguna dan penyewa (tenant) ke lapisan database driver.
290
+ 4. **Circuit Breakers & Rate Limits**: Batasi pemanggilan tool berulang dalam satu giliran respon untuk mencegah perulangan tak terkontrol (*infinite loops*).
291
+ 5. **Idempotency**: Semua tool yang memodifikasi data wajib mendukung argumen `idempotency_key`.
192
292
 
193
- ### Orkestrasi Multi-Server
194
- Klien MCP dapat terhubung ke beberapa server sekaligus, menyatukan semua tool dari server yang berbeda menjadi satu daftar yang tersedia untuk agen.
293
+ ## Integrasi Orkestrasi
294
+ - Terintegrasi dengan: `ai-llm-integration-expert`, `mcp-client-orchestrator`, `doku-mcp-server`, `zero-trust-secret-vault`.
@@ -0,0 +1,112 @@
1
+ ---
2
+ name: micro-frontend-architect
3
+ description: "Expert guide for designing Micro-Frontend architectures using Webpack Module Federation, Vite Federation, and Single-SPA for large scale Vue and React applications."
4
+ author: "Roedy Rustam"
5
+ ---
6
+
7
+ # Micro-Frontend Architect
8
+
9
+ [English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
10
+
11
+ ---
12
+
13
+ <a name="english"></a>
14
+ ## English
15
+
16
+ ### Orchestration & Integration
17
+ Connects and orchestrates with relevant domain skills like `brainstorming`, `zero-to-prod-orchestrator`, and `project-context-mapper` to ensure cohesive execution.
18
+
19
+ ### Description
20
+ Production-grade guidance for breaking down monolithic frontend applications into scalable, independently deployable **Micro-Frontends (MFE)**. Covers integration via **Webpack Module Federation**, **Vite Federation**, and run-time container orchestration using patterns suitable for massive Enterprise applications in Vue or React.
21
+
22
+ ### Trigger Conditions
23
+ Activate this skill when the user is:
24
+ - Splitting a large frontend codebase into multiple smaller apps (Host and Remotes).
25
+ - Configuring Webpack Module Federation (`ModuleFederationPlugin`).
26
+ - Setting up Vite with `@originjs/vite-plugin-federation`.
27
+ - Asking about sharing dependencies (e.g., sharing a single instance of Vue, React, or Pinia across apps).
28
+ - Designing a cross-team frontend deployment strategy.
29
+
30
+ ### Core Concepts
31
+
32
+ #### 1. Module Federation Concept
33
+ Module federation allows a JavaScript application to dynamically load code from another application at runtime.
34
+ - **Host (Shell):** The main container application that loads remote modules.
35
+ - **Remote:** The micro-frontend application exposing components or logic.
36
+
37
+ #### 2. Vite Federation Example
38
+ ```javascript
39
+ // vite.config.js (Remote App)
40
+ import federation from '@originjs/vite-plugin-federation'
41
+
42
+ export default {
43
+ plugins: [
44
+ federation({
45
+ name: 'remote_app',
46
+ filename: 'remoteEntry.js',
47
+ exposes: {
48
+ './Button': './src/components/Button.vue',
49
+ },
50
+ shared: ['vue', 'pinia'] // Critical: Share core dependencies!
51
+ })
52
+ ]
53
+ }
54
+
55
+ // vite.config.js (Host App)
56
+ import federation from '@originjs/vite-plugin-federation'
57
+
58
+ export default {
59
+ plugins: [
60
+ federation({
61
+ name: 'host_app',
62
+ remotes: {
63
+ remote_app: 'http://localhost:5001/assets/remoteEntry.js',
64
+ },
65
+ shared: ['vue', 'pinia']
66
+ })
67
+ ]
68
+ }
69
+ ```
70
+
71
+ #### 3. State Management Across MFEs
72
+ - **Avoid Global State if Possible:** Micro-frontends should ideally not share business state. Communicate via custom DOM events, URL parameters, or a thin Event Bus.
73
+ - **Shared Store (Pinia/Zustand):** If state sharing is absolutely required, the Host app should instantiate the store and share the dependency instance via Federation.
74
+
75
+ ### Best Practices
76
+ - **Strict Dependency Sharing:** Always mark core libraries (`react`, `react-dom`, `vue`, `vue-router`) as `singleton: true` and `shared` to prevent the browser from downloading and running multiple instances of the framework.
77
+ - **CSS Isolation:** Ensure CSS from one Micro-Frontend does not bleed into another. Use CSS Modules, scoped CSS, or Shadow DOM.
78
+ - **Independent Deployments:** The core value of MFE is that Team A can deploy the Remote App without requiring Team B to rebuild the Host App.
79
+
80
+ ---
81
+
82
+ ### Integration with Other Skills (MANDATORY)
83
+ This skill works best when combined with:
84
+ - `vue-frontend-expert` / `senior-frontend` — For building the individual micro-apps.
85
+ - `design-system-architect` — For ensuring all MFEs consume a shared, versioned UI component library.
86
+ - `monorepo-architect` — For managing the codebases of multiple MFEs in a single Turborepo/pnpm workspace.
87
+
88
+ ### Referenced By Orchestrators (MANDATORY)
89
+ - `brainstorming` — Add to "Architecture & Scale".
90
+ - `zero-to-prod-orchestrator` — Phase 2 (Architecture Strategy).
91
+
92
+ ---
93
+
94
+ <a name="bahasa-indonesia"></a>
95
+ ## Bahasa Indonesia
96
+
97
+ ### Integrasi Orkestrasi
98
+ Terhubung dan mengorkestrasi skill domain yang relevan seperti `brainstorming`, `zero-to-prod-orchestrator`, dan `project-context-mapper` untuk memastikan eksekusi yang kohesif.
99
+
100
+ ### Deskripsi
101
+ Panduan arsitektur untuk memecah aplikasi frontend raksasa menjadi **Micro-Frontends (MFE)** yang terukur dan dapat di-deploy secara independen. Mencakup **Webpack Module Federation** dan **Vite Federation**.
102
+
103
+ ### Kondisi Pemicu
104
+ - Memecah aplikasi (monolith) Vue atau React menjadi beberapa sub-aplikasi.
105
+ - Mengkonfigurasi plugin *Module Federation*.
106
+ - Mencari cara untuk membagi *dependency* (seperti Vue atau React) agar tidak di-download dua kali oleh browser.
107
+
108
+ ### Panduan Singkat
109
+ - **Host vs Remote:** *Host* adalah cangkang (shell) utama aplikasi Anda, *Remote* adalah aplikasi kecil (fitur) yang dimuat oleh Host secara dinamis di runtime.
110
+ - **Berbagi Dependensi (Shared):** Sangat krusial! Pastikan framework utama (`vue`, `react`, `pinia`, `vue-router`) ditandai sebagai `shared` (dan seringkali `singleton`). Jika tidak, aplikasi akan error karena ada 2 instance Vue/React yang berjalan bersamaan.
111
+ - **Isolasi CSS:** Pastikan gaya CSS dari MFE A tidak merusak MFE B. Gunakan *CSS Modules* atau kapsulasi *Scoped CSS*.
112
+ - **Komunikasi Data:** Hindari penggunaan Global State (Redux/Pinia) lintas MFE jika memungkinkan. Gunakan *Custom Event Listener* di `window` atau passing props/URL untuk menjaga tiap MFE tetap independen.