buzzberg-mcp 0.1.0b1__tar.gz

buzzberg_mcp-0.1.0b1/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,20 @@
+---
+name: Bug report
+about: Report an installer or documentation bug
+title: "[bug] "
+labels: bug
+---
+
+## What happened?
+
+## Client
+
+Claude Desktop / Claude Code / Cursor / Cline / Continue.dev / other:
+
+## Installer version
+
+`buzzberg-mcp version`:
+
+## Notes
+
+Do not paste API keys or client config files containing Bearer tokens.

buzzberg_mcp-0.1.0b1/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,10 @@
+---
+name: Feature request
+about: Suggest an installer or documentation improvement
+title: "[feature] "
+labels: enhancement
+---
+
+## What should change?
+
+## Why does it matter?

buzzberg_mcp-0.1.0b1/.github/ISSUE_TEMPLATE/security.md

@@ -0,0 +1,11 @@
+---
+name: Security report
+about: Do not file public vulnerability reports
+title: "[security] do not use public issues"
+labels: security
+---
+
+Please email security reports to security@buzzberg.ai.
+
+Do not include secrets, API keys, exploit details, or vulnerability reports in a
+public GitHub issue.

buzzberg_mcp-0.1.0b1/.github/workflows/ci.yml

@@ -0,0 +1,55 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        # actions/checkout v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - name: Set up Python
+        # actions/setup-python v5.6.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: "3.12"
+      - name: Install dev dependencies
+        run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]"
+      - name: Ruff
+        run: ruff check .
+      - name: Mypy
+        run: mypy buzzberg_mcp
+      - name: Pytest
+        run: pytest
+      - name: Validate public docs
+        run: |
+          python - <<'PY'
+          import json, pathlib, re, sys
+          root = pathlib.Path(".")
+          manifest = json.loads((root / "tools_manifest.json").read_text())
+          expected = {tool["name"] for tool in manifest["tools"]}
+          headings = set(re.findall(r"^## ([a-z_]+)$", (root / "TOOLS.md").read_text(), re.M))
+          if headings != expected:
+              print("TOOLS.md mismatch")
+              print("missing:", sorted(expected - headings))
+              print("extra:", sorted(headings - expected))
+              sys.exit(1)
+          forbidden = re.compile("|".join(["n1" + "fan", r"github\.com/n1" + "fan", r"ghcr\.io/n1" + "fan"]))
+          bad = []
+          for path in root.rglob("*"):
+              if path.is_dir() or ".git" in path.parts or "__pycache__" in path.parts or ".pytest_cache" in path.parts:
+                  continue
+              text = path.read_text(encoding="utf-8", errors="ignore")
+              if forbidden.search(text):
+                  bad.append(str(path))
+          if bad:
+              print("Forbidden references:", bad)
+              sys.exit(1)
+          PY

buzzberg_mcp-0.1.0b1/.github/workflows/release.yml

@@ -0,0 +1,34 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+    steps:
+      - name: Checkout
+        # actions/checkout v4.2.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - name: Set up Python
+        # actions/setup-python v5.6.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: "3.12"
+      - name: Install build dependencies
+        run: python -m pip install --upgrade pip && python -m pip install build==1.2.2.post1 twine==6.1.0
+      - name: Build
+        run: python -m build
+      - name: Check distributions
+        run: python -m twine check dist/*
+      - name: Publish to PyPI
+        # pypa/gh-action-pypi-publish v1.13.0 peeled commit
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e

buzzberg_mcp-0.1.0b1/.gitignore

@@ -0,0 +1,11 @@
+.env
+*.key
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+dist/
+build/
+*.egg-info/
+*.buzzberg.bak.*

buzzberg_mcp-0.1.0b1/CHANGELOG.md

@@ -0,0 +1,13 @@
+# Changelog
+
+## Beta Period
+
+SemVer is not guaranteed before `1.0.0`. Breaking changes will be documented
+here and announced to active beta users.
+
+## 0.1.0b1
+
+- Initial private beta installer package.
+- Adds stdlib-only client config writers for Claude Desktop, Claude Code,
+  Cursor, Cline, and Continue.dev.
+- Adds public SECURITY.md, TOOLS.md, examples, and release workflow skeleton.

buzzberg_mcp-0.1.0b1/INSTALL.md

@@ -0,0 +1,164 @@
+# Install Buzzberg MCP
+
+## Recommended Install
+
+```bash
+pip install buzzberg-mcp
+buzzberg-mcp setup
+```
+
+For one client:
+
+```bash
+buzzberg-mcp setup --client cursor
+```
+
+For all detected clients:
+
+```bash
+buzzberg-mcp setup --all
+```
+
+The installer reads your key through a hidden prompt by default. For password
+managers, use stdin:
+
+```bash
+pass show buzzberg/mcp | buzzberg-mcp setup --key-stdin --client claude-desktop
+```
+
+Dry-runs do not need a real key and never print a plaintext key:
+
+```bash
+buzzberg-mcp setup --dry-run --client claude-desktop
+```
+
+## Paranoid Path
+
+This path lets you inspect the wheel before installing it. It is the path for
+"read before running"; a normal `pip install` may run package build/install code
+by design.
+
+```bash
+pip download --only-binary :all: --no-deps buzzberg-mcp -d /tmp/bz
+python -m zipfile -l /tmp/bz/buzzberg_mcp-*.whl
+python -m pip install /tmp/bz/buzzberg_mcp-*.whl
+```
+
+Attestation verification is optional. The exact `pypi-attestations verify`
+command will be copied here after it passes the Test PyPI smoke test.
+
+## Manual Install
+
+Use this path if your security policy forbids installing packages. Add the
+Buzzberg server to your client config manually.
+
+Transport: `sse`
+URL: `https://mcp.buzzberg.ai/sse`
+Header: `Authorization: Bearer <key from Profile -> MCP Access>`
+
+### Claude Desktop
+
+macOS:
+`~/Library/Application Support/Claude/claude_desktop_config.json`
+
+Windows:
+`%APPDATA%/Claude/claude_desktop_config.json`
+
+Linux:
+`~/.config/Claude/claude_desktop_config.json`
+
+```json
+{
+  "mcpServers": {
+    "buzzberg": {
+      "url": "https://mcp.buzzberg.ai/sse",
+      "headers": {
+        "Authorization": "Bearer <BUZZBERG_MCP_API_KEY>"
+      }
+    }
+  }
+}
+```
+
+### Claude Code
+
+```bash
+claude mcp add --transport sse buzzberg https://mcp.buzzberg.ai/sse \
+  --header "Authorization: Bearer $BUZZBERG_MCP_API_KEY"
+```
+
+### Claude Mobile
+
+Use URL `https://mcp.buzzberg.ai/sse` and header
+`Authorization: Bearer <BUZZBERG_MCP_API_KEY>` where the mobile integration UI
+supports custom headers. If headers are unavailable, use Desktop, Code, Cursor,
+or Cline during private beta.
+
+### Cursor
+
+Settings -> MCP Servers -> Add new:
+
+```json
+{
+  "mcpServers": {
+    "buzzberg": {
+      "url": "https://mcp.buzzberg.ai/sse",
+      "headers": {
+        "Authorization": "Bearer <BUZZBERG_MCP_API_KEY>"
+      }
+    }
+  }
+}
+```
+
+### Cline
+
+VS Code -> Cline -> Settings -> Edit MCP Settings. Add the same `mcpServers`
+block used for Cursor.
+
+### Continue.dev
+
+Edit `~/.continue/config.json`:
+
+```json
+{
+  "experimental": {
+    "modelContextProtocolServers": [
+      {
+        "name": "buzzberg",
+        "transport": {
+          "type": "sse",
+          "url": "https://mcp.buzzberg.ai/sse",
+          "headers": {
+            "Authorization": "Bearer <BUZZBERG_MCP_API_KEY>"
+          }
+        }
+      }
+    ]
+  }
+}
+```
+
+### Agent SDK
+
+```python
+from claude_agent_sdk import ClaudeAgentOptions
+
+options = ClaudeAgentOptions(
+    mcp_servers={
+        "buzzberg": {
+            "type": "sse",
+            "url": "https://mcp.buzzberg.ai/sse",
+            "headers": {"Authorization": f"Bearer {KEY}"},
+        }
+    },
+    allowed_tools=["mcp__buzzberg__*"],
+)
+```
+
+## Troubleshooting
+
+- Tools do not appear: fully quit and reopen the client, then validate JSON.
+- 401 Unauthorized: revoke and recreate the key in Profile -> MCP Access.
+- Connection timeout: corporate networks sometimes block SSE.
+- Health check: `curl https://mcp.buzzberg.ai/health` should return `{"status":"ok"}`.

buzzberg_mcp-0.1.0b1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Buzzberg
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

buzzberg_mcp-0.1.0b1/PKG-INFO

@@ -0,0 +1,105 @@
+Metadata-Version: 2.4
+Name: buzzberg-mcp
+Version: 0.1.0b1
+Summary: Buzzberg MCP installer for Claude / Cursor / Cline / Continue.dev
+Project-URL: Homepage, https://buzzberg.ai
+Project-URL: Repository, https://github.com/buzzberg-ai/buzzberg-mcp
+Project-URL: Issues, https://github.com/buzzberg-ai/buzzberg-mcp/issues
+Author: Buzzberg
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Financial and Insurance Industry
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Utilities
+Requires-Python: >=3.10
+Provides-Extra: dev
+Requires-Dist: build==1.2.2.post1; extra == 'dev'
+Requires-Dist: mypy==1.15.0; extra == 'dev'
+Requires-Dist: pytest==8.3.5; extra == 'dev'
+Requires-Dist: ruff==0.11.2; extra == 'dev'
+Requires-Dist: twine==6.1.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# Buzzberg MCP
+
+![status](https://img.shields.io/badge/status-private--beta-orange)
+
+> Private Beta: the MCP contract can change before broader beta. See
+> [CHANGELOG.md](CHANGELOG.md) for breaking changes.
+
+Buzzberg MCP connects Claude, Cursor, Cline, Continue.dev, and other MCP clients
+to Buzzberg market intelligence: trade ideas, sentiment, speakers, prices, and
+watchlist actions for your own Buzzberg account.
+
+## Quickstart
+
+```bash
+pip install buzzberg-mcp
+buzzberg-mcp setup
+```
+
+The setup command uses an interactive hidden prompt for your key. Get a personal
+key from `https://buzzberg.ai -> Profile -> MCP Access`.
+
+## What Your Key Can Do
+
+| Action | Allowed? |
+|---|---|
+| Read public trade ideas, sentiment, and prices | Yes |
+| Add/remove tickers in your watchlist | Yes |
+| Save trade ideas to your account | Yes |
+| Server sees tool-call arguments Claude sends | Yes* |
+| See another user's watchlist or saved ideas | No |
+| Change another user's watchlist or saved ideas | No |
+| Place trades on an exchange | No |
+| See your full Claude conversation | No |
+| Access your X, broker, or other accounts | No |
+| Download files from your computer | No |
+
+*Buzzberg receives only MCP requests and tool arguments selected by your client,
+not your full Claude transcript. Avoid putting sensitive private text into tool
+arguments.
+
+## Supported Clients
+
+| Client | Status |
+|---|---|
+| Claude Desktop | Supported |
+| Claude Code | Supported via SSE beta transport |
+| Cursor | Supported |
+| Cline | Supported |
+| Continue.dev | Supported |
+| Claude Mobile | Works only where custom headers are available |
+| Agent SDK | Manual config supported |
+
+Private beta currently uses SSE at `https://mcp.buzzberg.ai/sse`. Streamable
+HTTP `/mcp` ships before broader beta; `/sse` will remain for legacy clients for
+a migration window.
+
+## Tools
+
+Buzzberg exposes 17 tools. See [TOOLS.md](TOOLS.md) for signatures and examples.
+
+## Trust And Verification
+
+The normal path is `pip install buzzberg-mcp`. pip uses HTTPS and package hashes
+from the index for download integrity, but pip does not automatically verify
+Sigstore attestations.
+
+Buzzberg releases use PyPI Trusted Publishing through GitHub OIDC. Attestations
+are available for manual verification; the exact command will be published after
+the Test PyPI smoke test confirms the working `pypi-attestations` syntax.
+
+Read more in [SECURITY.md](SECURITY.md).
+
+## Links
+
+- [INSTALL.md](INSTALL.md)
+- [SECURITY.md](SECURITY.md)
+- [TOOLS.md](TOOLS.md)
+- [examples](examples)
+- [sessions](sessions)
+- [CHANGELOG.md](CHANGELOG.md)

buzzberg_mcp-0.1.0b1/README.md

@@ -0,0 +1,80 @@
+# Buzzberg MCP
+
+![status](https://img.shields.io/badge/status-private--beta-orange)
+
+> Private Beta: the MCP contract can change before broader beta. See
+> [CHANGELOG.md](CHANGELOG.md) for breaking changes.
+
+Buzzberg MCP connects Claude, Cursor, Cline, Continue.dev, and other MCP clients
+to Buzzberg market intelligence: trade ideas, sentiment, speakers, prices, and
+watchlist actions for your own Buzzberg account.
+
+## Quickstart
+
+```bash
+pip install buzzberg-mcp
+buzzberg-mcp setup
+```
+
+The setup command uses an interactive hidden prompt for your key. Get a personal
+key from `https://buzzberg.ai -> Profile -> MCP Access`.
+
+## What Your Key Can Do
+
+| Action | Allowed? |
+|---|---|
+| Read public trade ideas, sentiment, and prices | Yes |
+| Add/remove tickers in your watchlist | Yes |
+| Save trade ideas to your account | Yes |
+| Server sees tool-call arguments Claude sends | Yes* |
+| See another user's watchlist or saved ideas | No |
+| Change another user's watchlist or saved ideas | No |
+| Place trades on an exchange | No |
+| See your full Claude conversation | No |
+| Access your X, broker, or other accounts | No |
+| Download files from your computer | No |
+
+*Buzzberg receives only MCP requests and tool arguments selected by your client,
+not your full Claude transcript. Avoid putting sensitive private text into tool
+arguments.
+
+## Supported Clients
+
+| Client | Status |
+|---|---|
+| Claude Desktop | Supported |
+| Claude Code | Supported via SSE beta transport |
+| Cursor | Supported |
+| Cline | Supported |
+| Continue.dev | Supported |
+| Claude Mobile | Works only where custom headers are available |
+| Agent SDK | Manual config supported |
+
+Private beta currently uses SSE at `https://mcp.buzzberg.ai/sse`. Streamable
+HTTP `/mcp` ships before broader beta; `/sse` will remain for legacy clients for
+a migration window.
+
+## Tools
+
+Buzzberg exposes 17 tools. See [TOOLS.md](TOOLS.md) for signatures and examples.
+
+## Trust And Verification
+
+The normal path is `pip install buzzberg-mcp`. pip uses HTTPS and package hashes
+from the index for download integrity, but pip does not automatically verify
+Sigstore attestations.
+
+Buzzberg releases use PyPI Trusted Publishing through GitHub OIDC. Attestations
+are available for manual verification; the exact command will be published after
+the Test PyPI smoke test confirms the working `pypi-attestations` syntax.
+
+Read more in [SECURITY.md](SECURITY.md).
+
+## Links
+
+- [INSTALL.md](INSTALL.md)
+- [SECURITY.md](SECURITY.md)
+- [TOOLS.md](TOOLS.md)
+- [examples](examples)
+- [sessions](sessions)
+- [CHANGELOG.md](CHANGELOG.md)

buzzberg_mcp-0.1.0b1/SECURITY.md

@@ -0,0 +1,75 @@
+# Security Policy
+
+## Reporting
+
+Email security issues to `security@buzzberg.ai`. We acknowledge reports within
+72 hours. Please do not file public GitHub issues for vulnerabilities.
+
+## Threat Model
+
+Buzzberg MCP is a hosted remote MCP server. The public package in this repo is
+an installer and documentation package; it is not the server implementation.
+
+- Confused deputy: the server resolves each Bearer key to a server-side user
+  context. Write tools use that context and do not accept user-id overrides.
+- Token passthrough: Buzzberg MCP keys are not passed to downstream market-data
+  providers.
+- Session hijacking: there is no server-side session cookie for MCP. Each request
+  authenticates with a Bearer key.
+- SSRF: tool inputs are not arbitrary outbound HTTP URLs.
+- Local installer compromise: installer code is public in this repo and releases
+  are published with PyPI Trusted Publishing through GitHub OIDC.
+
+See [security-controls.json](security-controls.json) for the sanitized public
+mapping of scope claims to enforcement mechanisms.
+
+## What Your Key Can And Cannot Do
+
+| Action | Allowed? |
+|---|---|
+| Read public trade ideas, sentiment, and prices | Yes |
+| Add/remove tickers in your watchlist | Yes |
+| Save trade ideas to your account | Yes |
+| Server sees tool-call arguments Claude sends | Yes |
+| See another user's watchlist or saved ideas | No |
+| Change another user's watchlist or saved ideas | No |
+| Place trades on an exchange | No |
+| See your full Claude conversation | No |
+| Access your X, broker, or other accounts | No |
+| Download files from your computer | No |
+
+## Key Storage
+
+MCP keys are generated as `bzb_` plus a high-entropy random value from
+`secrets.token_urlsafe(32)`. Buzzberg stores a SHA-256 hash of the key, not the
+raw key. SHA-256 is appropriate here because the secret is random and high
+entropy; this is not a low-entropy password.
+
+## Logging
+
+Buzzberg stores `last_used_at` per key and standard HTTP access logs such as
+path, status, IP, and response time. Buzzberg does not intentionally log request
+bodies, tool arguments, or MCP response payloads. Per-tool audit logs are on the
+roadmap but are not present in this beta.
+
+## What The Server Can See
+
+The server receives MCP requests and tool arguments sent by your client. Tool
+arguments are visible to Buzzberg. The server does not receive your full Claude
+conversation unless your client chooses to include text from that conversation
+inside a tool argument.
+
+## Key Lifecycle
+
+Create keys in Buzzberg Profile -> MCP Access. Revoke keys from the same page.
+Revoked keys stop authenticating once their `revoked_at` timestamp is set.
+
+If the server is compromised, Buzzberg will revoke all active MCP keys, require
+re-issue, and email active MCP users within 72 hours.
+
+## Attestation Verification
+
+pip does not automatically verify Sigstore attestations. Buzzberg releases use
+PyPI Trusted Publishing through GitHub OIDC, and attestations are available for
+manual verification. The exact `pypi-attestations verify` command will be added
+after the Test PyPI smoke test validates the working syntax.