@vibevo/mcp - npm Package Compare versions

Comparing version 0.1.1 to 0.1.2

dist/index.js

@@ -72,3 +72,3 @@ #!/usr/bin/env node
 }
-const server = new McpServer({ name: 'vibevo', version: '0.1.0' });
+const server = new McpServer({ name: 'vibevo', version: '0.1.2' });
 server.registerTool('vibevo_whoami', {
@@ -75,0 +75,0 @@ title: 'Who am I',

package.json

 {
   "name": "@vibevo/mcp",
-  "version": "0.1.1",
+  "version": "0.1.2",
+  "mcpName": "io.vibevo/vibevo",
   "description": "MCP server exposing the VibeVO Public API as agent tools (AIPROD-204).",
   "type": "module",
   "license": "MIT",
-  "homepage": "https://docs.vibevo.io/docs/api/mcp",
+  "homepage": "https://docs.vibevo.io/docs/en/api/mcp",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/VibeVO-io/VibeVO.git",
+    "directory": "mcp"
+  },
   "keywords": [
@@ -9,0 +15,0 @@ "mcp",

README.md

 # @vibevo/mcp — VibeVO MCP server (AIPROD-204)
 
-MCP server that exposes the [VibeVO Public API](../services/core/docs/features/public-api-mcp.md)
+MCP server that exposes the [VibeVO Public API](https://docs.vibevo.io/docs/en/api)
 as agent tools, so AI agents (Claude Desktop, IDE agents, custom runners) can
@@ -19,2 +19,3 @@ discover and operate VibeVO programmatically.
 | `vibevo_list_offers`                  | `GET /public/offers`                                 | `read`        |
+| `vibevo_list_my_posts`                | `GET /public/posts`                                  | `read`        |
 | `vibevo_list_campaigns`               | `GET /public/campaigns`                              | `read`        |
@@ -109,29 +110,15 @@ | `vibevo_get_campaign`                 | `GET /public/campaigns/{id}`                         | `read`        |
 
-`server.json` is the registry manifest (official
-[`server.json` schema](https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json),
-`io.modelcontextprotocol.registry` format). It declares the server name
-(`io.vibevo/vibevo`), version, the npm package, the `stdio` transport and the
-runtime env vars (`VIBEVO_API_KEY` required+secret, `VIBEVO_API_BASE_URL`
-optional). Publishing is a manual step the owner runs; nothing here is
-automated.
+`server.json` is the manifest for the official MCP Registry and targets the
+[`2025-12-11` schema](https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json).
+The server name is `io.vibevo/vibevo`; ownership of the `io.vibevo` namespace
+is verified through the `vibevo.io` DNS zone. The npm package declares the same
+name in `mcpName`, which the Registry checks during publication.
 
-> **Open decision (owner's call):** WHICH registry and namespace to publish to
-> — the official public `modelcontextprotocol` registry vs. a self-hosted one,
-> and the exact reverse-DNS namespace (`io.vibevo/…` assumes control of the
-> `vibevo.io` domain for DNS-based namespace verification; a
-> `io.github.<org>/…` name would use GitHub verification instead). Adjust
-> `name` in `server.json` to a namespace the org actually controls before
-> publishing. Tracked as an open question on the Public API + MCP epic.
-
 ### Prerequisites
 
-1. **Publish the npm package first.** `package.json` is publish-ready (public
-   scope via `publishConfig`, a `files` allowlist, `prepublishOnly` build). The
-   registry entry points at the npm package `@vibevo/mcp`, so that package must
-   exist on npm (`npm publish` from `mcp/`) — or switch the `packages` entry to
-   an `mcpb`/remote type if you don't want a public npm release. Keep the
-   `version` in `server.json` in sync with `package.json`.
-2. **Own the namespace.** For `io.vibevo/*` you prove control of `vibevo.io`
-   via a DNS TXT record; for `io.github.<org>/*` you authenticate the GitHub
-   org/user. Pick whichever the org controls and set `name` accordingly.
+1. **Publish the npm package first.** Run `npm publish` from `mcp/`. Keep the
+   npm package version, the MCP runtime version and both versions in
+   `server.json` aligned.
+2. **Own the namespace.** Publish the Registry public key as a TXT record on
+   `vibevo.io`; never commit the private key.
 
@@ -141,21 +128,17 @@ ### Steps (run manually)
 ```bash
-# 1. Install the publisher CLI (see the modelcontextprotocol registry docs for
-#    the current install method / release binary).
-#    e.g. via Go:  go install github.com/modelcontextprotocol/registry/cmd/mcp-publisher@latest
+# 1. Install the official publisher CLI.
+brew install mcp-publisher
 
-# 2. Authenticate for your namespace (DNS or GitHub verification).
-mcp-publisher login dns --domain vibevo.io      # for an io.vibevo/* name
-# or:  mcp-publisher login github               # for an io.github.<org>/* name
+# 2. Authenticate after the DNS TXT record has propagated.
+#    The environment variable contains the raw private-key hex, not a PEM path.
+mcp-publisher login dns --domain vibevo.io --private-key "$MCP_REGISTRY_PRIVATE_KEY"
 
 # 3. Validate + publish using this manifest.
 cd mcp
-mcp-publisher publish            # reads ./server.json
+mcp-publisher validate ./server.json
+mcp-publisher publish ./server.json
 ```
 
-> **Schema caveat:** the registry `server.json` schema is versioned and still
-> evolving. This file targets the `2025-07-09` schema (camelCase fields:
-> `registryType`, `environmentVariables`, `isRequired`, `isSecret`). If
-> `mcp-publisher` rejects a field, re-check against the schema URL pinned in
-> `$schema` and adjust — the field names/casing are the most likely thing to
-> drift between schema versions.
+After publication, verify the entry through the
+[Registry API](https://registry.modelcontextprotocol.io/v0.1/servers?search=io.vibevo%2Fvibevo).
 
@@ -162,0 +145,0 @@ ## DoD e2e (AIPROD-204)

server.json

 {
-  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json",
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.vibevo/vibevo",
-  "description": "MCP server exposing the VibeVO Public API as agent tools: campaigns, offers, analytics, posts, creators, tracking links, wallet and content factories (read), plus factory management and video submission (write, gated by your key's scopes). Authenticated with a VibeVO API key.",
-  "version": "0.1.1",
+  "title": "VibeVO",
+  "description": "Use VibeVO API tools for campaigns, analytics, posts, creators, wallets, and factories.",
+  "version": "0.1.2",
+  "websiteUrl": "https://docs.vibevo.io/docs/en/api/mcp",
   "repository": {
-    "url": "https://github.com/vibevo/VibeVO",
-    "source": "github"
+    "url": "https://github.com/VibeVO-io/VibeVO",
+    "source": "github",
+    "subfolder": "mcp"
   },
@@ -14,3 +17,3 @@ "packages": [
       "identifier": "@vibevo/mcp",
-      "version": "0.1.1",
+      "version": "0.1.2",
       "transport": {
@@ -22,3 +25,4 @@ "type": "stdio"
           "name": "VIBEVO_API_KEY",
-          "description": "VibeVO Public API key (vibevo_live_... or vibevo_test_...). Mint it in the VibeVO cabinet with the scopes the agent needs.",
+          "description": "VibeVO Public API key (vibevo_live_...). Mint it in the VibeVO cabinet with the scopes the agent needs.",
+          "format": "string",
           "isRequired": true,
@@ -30,2 +34,3 @@ "isSecret": true
           "description": "Base URL of the VibeVO API. Optional; defaults to https://api.vibevo.io.",
+          "format": "string",
           "isRequired": false,
@@ -32,0 +37,0 @@ "isSecret": false,

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

No repository

Supply chain risk

Package does not have a linked source code repository. Without this field, a package will have no reference to the location of the source code use to generate the package.

Improved metrics

Lines of code

428

1.18%

Number of low supply chain risk alerts

3

-25%

Number of medium supply chain risk alerts

2

-33.33%

Worsened metrics

Total package byte prevSize

38342

-3.5%

Number of lines in readme file

146

-10.43%

No dependency changes