🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP
Sign In

boutique-mcp

Package Overview
Dependencies
Maintainers
1
Versions
2
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

boutique-mcp

Local MCP catalog of MateMatic Boutique: find the right legal-data connector or skill and get a local install command. No proxy, no query logging.

pipPyPI
Version
0.1.1
Weekly downloads
133
Maintainers
1

boutique-mcp

A local MCP catalog of MateMatic Boutique: 103 entries at the time of writing - 43 legal-data MCP connectors (SAOS, CBOSA, EUR-Lex, national ELI servers from Austria to Japan), 52 MateMatic agent skills and 8 curated third-party skills.

It answers one question: which building block solves the task at hand, and how to install it locally. The catalog points, it never proxies. Your agent gets a copy-paste uvx/npx command or a download link and runs it on your machine.

Status: v0.1.0 | License: Apache-2.0 | Maintainer: MateMatic

Why local

A hosted discovery API sees every query it answers, and in legal work the query itself is often confidential ("counter-arguments to our client's position in..."). This connector never sees anything: search runs in-process over a local copy of catalog.json. The only network request it ever makes is a conditional GET of the public catalog itself (ETag / If-None-Match).

No network? You get the last catalog cached on disk, or the snapshot shipped inside the package. Either way the response says where the data came from and how old it is: "catalog generated on X, source: network / disk-cache / bundled-snapshot". Nothing is installed or executed for you. The catalog returns commands; you run them.

MCP tools

  • boutique_search(query, jurisdiction?, entry_type?, limit?) - keyword search (English, Polish or Portuguese) over the catalog. Every hit carries a local install command. When coverage is missing, the response says so in gaps[] instead of padding weak matches.
  • boutique_get(id) - the full card for one entry: names and descriptions in every available language, install, version, license, source and card URLs.
  • boutique_whats_new(since_date?) - what was added or updated since a date (default: the 30 days before the catalog was generated).
  • boutique_request_coverage(description, jurisdiction?) - drafts a coverage-request issue for a gap. Draft only: nothing is sent anywhere; a human reviews and submits it.

Quickstart

uvx boutique-mcp

MCP client configuration (mcp-servers.json):

{
  "mcpServers": {
    "boutique": {
      "command": "uvx",
      "args": ["boutique-mcp"]
    }
  }
}

Windows 11 ze Smart App Control

Smart App Control blokuje niepodpisane pliki wykonywalne, a uvx.exe, pip.exe i generowany przy instalacji boutique-mcp.exe podpisane nie sa. python.exe z python.org jest podpisany przez Python Software Foundation, wiec uruchomienie przez modul omija blokade:

python -m pip install boutique-mcp
python -m boutique_mcp
{ "mcpServers": { "boutique-mcp": { "command": "python", "args": ["-m", "boutique_mcp"] } } }

Nie wylaczaj Smart App Control, zeby to obejsc - wylaczenia nie da sie cofnac bez ponownej instalacji systemu.

Configuration

EnvDefaultMeaning
BOUTIQUE_MCP_CATALOG_URLhttps://matematicsolutions.com/catalog.jsonCatalog source
BOUTIQUE_MCP_CACHE_DIR~/.matematic/cache/boutique-mcpDisk cache location
BOUTIQUE_MCP_OFFLINEunset1 = never touch the network
BOUTIQUE_MCP_AUDITunset1 = opt-in local audit log (tool name + timing only, never query content)

Data source

catalog.json is generated in the www-matematic repository from the same source as the Boutique page tiles (three languages); a pre-commit and CI check fails whenever the two drift apart. A machine-readable server card lives at /.well-known/mcp/server-card.json.

Development

python -m venv .venv
.venv/bin/pip install -e ".[dev]"        # Windows: .venv\Scripts\pip
.venv/bin/python -m pytest tests/ -q     # offline - fixture catalog
.venv/bin/python -m ruff check src tests

Governance

The project constitution forbids a hosted discover/invoke proxy and any logging of query content. The only adoption metric MateMatic sees is the CDN download counter of the public catalog.json file. The one tool that produces outbound text, boutique_request_coverage, stops at a draft; a human submits it.

Constitution and spec: .matematic/ in this repository.

Keywords

boutique

FAQs

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts