mcp-server

Public MCP Readiness Receipt

Metadata

• receipt_id: public_mcp_readiness_receipt_v1
• server_name: hummbl-mcp-server
• server_url: https://github.com/hummbl-dev/mcp-server
• read_only_hint: true
• purpose: Public readiness evidence for Apps SDK + MCP public exposure claims (no certification)

Public surface

public_tools

• get_model
• list_all_models
• search_models
• recommend_models (optional via HUMBL_API_KEY when available)
• get_transformation
• search_problem_patterns
• export_models
• get_methodology
• audit_model_references
• Resources: model-by-code, transformation-models, all-models, self-dialectical-methodology, self-dialectical-methodology-markdown
• Prompts: root_cause_analysis, strategy_design, decision_making, analyze_with_models, apply_model

excluded_tools

• REST auth-required endpoints and admin-only routes in src/api.ts:
  • /v1/relationships (write)
  • /v1/relationships/seed (admin only)
  • Any endpoint requiring Authorization: Bearer <key>
• Internal/ops tooling and infrastructure routes not intended for Apps SDK public copy

Enforcement and trust boundaries

read_only_enforcement_test

• MCP route for this package must remain non-destructive at tool-level (no tool that mutates model graph state is in public package toolset).
• Public docs must avoid exposing API key administration, workflow side effects, or DB mutation behavior as Apps SDK path.
• Pending follow-up: add explicit runtime assertion in package publication checks if/when public tool registry is versioned independently.

server_tool_registration_proof

• Canonical docs: README.md, SUBMISSION_PACKAGE.md, docs/user-guide.md
• Runtime entry points: src/index.ts, tool registry in src/tools/, and src/resources/
• This file serves as the public-facing readiness artifact requested in issue #374.

apps_sdk_metadata

• MCP package metadata is visible via npm and SUBMISSION_PACKAGE.md.
• Tool/resource names are declared in package docs; Apps SDK registration metadata is not separately split into a dedicated manifest in this repo yet.
• README currently links glama.ai package metadata badge path for public package discovery.

structured_output_schema

• MCP tools emit JSON responses.
• Server-side validation for tool outputs is driven through shared TypeScript types (src/types/*) and test fixtures.

widget_csp

• No public Apps SDK widgets are shipped in this repo at this time.
• Widget/CSP boundary therefore applies as not yet in scope; this does not reduce read-only MCP claims.

auth_model

• MCP package: no user-authenticated path required in current public package docs.
• REST API: API-key based auth and admin checks remain in src/api.ts.

future_authz_boundary

• oauth_status: planned, not implemented
• resource_indicator_plan: planned in follow-up Apps SDK hardening issue
• audience_validation_plan: planned before OAuth goes live
• token_passthrough_forbidden: explicit (no token passthrough in current public MCP package path)
• 401_403_contract: scoped to REST; Apps SDK read-only path does not require bearer tokens
• pkce_required: planned with OAuth rollout
• redirect_uri_exact_match: planned with OAuth rollout and App registration controls

rate_limit

• MCP stdio transport: n/a
• REST API: existing rate-limits remain enforced in src/auth/api-keys.ts for authenticated endpoints.

privacy_boundary

• Public MCP docs are package-install and analysis-facing only.
• Server behavior remains local/process-centric for local MCP install path; REST route behavior is out-of-scope for this Apps SDK/public-readiness receipt.

abuse_boundary

• Public MCP package is intended as read-only analysis tooling.
• Destructive model-graph mutations are not part of this public issue surface.

claim_ceiling

• This receipt is readiness evidence only.
• It does not assert OAuth completeness, compliance, or public certification status.

Evidence pointers

• README.md (tool inventory, install route)
• SUBMISSION_PACKAGE.md (package evidence pack)
• docs/user-guide.md (usage + copy guidance)
• src/index.ts, src/tools/*, src/resources/*
• Related issues: #348, #350, #316, #327

do_not_infer

• No claims about OAuth implementation are made.
• No claims about full production App platform compliance are made.
• No claims that all Apps SDK fields are fully generated by HUMMBL runtime metadata.

Local validation command

• rg --line-number "public_tools|excluded_tools|read_only_enforcement_test|future_authz_boundary" docs/public_mcp_readiness_receipt.md

Status notes

This is readiness evidence for public MCP claim hygiene. It is explicitly bounded to docs/schema-level evidence and does not ship runtime enforcement changes.

This site is open source. Improve this page.