chore(release): 0.4.1

.github/workflows/ci.yml

@@ -28,5 +28,5 @@ jobs:
           node -e 'import("@corbits/mcp/client").then((m) => { for (const n of ["mcpInitialize", "mcpListTools", "mcpCallTool"]) if (typeof m[n] !== "function") throw new Error("missing export: " + n); })'
           mkdir -p "$RUNNER_TEMP/host" && cd "$RUNNER_TEMP/host"
           npm init -y >/dev/null && npm pkg set type=module >/dev/null
-          npm install "$TARBALL" @intx/agent@0.5.0 @corbits/oauth-core@0.3.2
+          npm install "$TARBALL" @intx/agent@0.5.0 @intx/harness@0.5.0 @corbits/oauth-core@0.3.3
           node -e 'import("@corbits/mcp").then((m) => { for (const n of ["mcpTools", "mcpInitialize", "mcpListTools", "mcpCallTool"]) if (typeof m[n] !== "function") throw new Error("missing export: " + n); })'

README.md

@@ -47,30 +47,70 @@ or certify the host's sandbox. See [scope and evidence](docs/conformance.md).
 
 ## Install
 
+`@corbits/mcp@0.4.1` is the package. Neutral imports `@corbits/mcp/client` and
+`@corbits/mcp/server` need no Interchange or OAuth peers.
+
 ```bash
 bun add @corbits/mcp
-# For Interchange consumption:
-bun add @intx/agent @intx/harness
-# Historical root / guarded OAuth login also requires OAuth-core:
-bun add @corbits/oauth-core@0.3.0
+# For Interchange consumption (optional peers ^0.5.0):
+bun add @intx/agent@0.5.0 @intx/harness@0.5.0
+# Historical root entry and guarded OAuth login (optional peer ^0.3.3):
+bun add @corbits/oauth-core@0.3.3
 ```
 
 Runs on Node.js 24+ and Bun 1.2+.
 
-Standalone client/server entries do not require OAuth-core or Interchange host
-peers. OAuth-core is now an **optional peer**, not a mandatory dependency: this
-is a breaking installation change for the historical root and OAuth login users,
-who must explicitly install it as shown above. Installing OAuth-core still brings
+OAuth-core is an **optional peer**, not a mandatory dependency: this is a
+breaking installation change for the historical root and OAuth login users, who
+must explicitly install it as shown above. Installing OAuth-core still brings
 its own DB/hub/Hono dependencies; that host installation is separate from the
-neutral package. See [public API dependency notes](docs/public-api.md) for the
-credential-http/harness/types peer conflict affecting the full hub setup.
+neutral package. See [public API dependency notes](docs/public-api.md).
 
-For the `@corbits/mcp/hub` routes, also install:
+For hub discovery, `@corbits/credential-http` is an optional peer (`^0.1.3`).
+Install `@corbits/credential-http@0.1.3`. That release accepts `@intx/harness`
+and `@intx/types` `^0.5.0`. The other hub packages:
 
 ```bash
-bun add @corbits/credential-http @intx/authz @intx/crypto @intx/db @intx/hub-api drizzle-orm hono
+bun add @intx/authz @intx/crypto @intx/db @intx/hub-api drizzle-orm hono
+```
+
+## Use it from an agent
+
+List tools with the standalone client. That import needs no Interchange or OAuth
+peers:
+
+```ts
+import { mcpConnect, mcpListTools } from "@corbits/mcp/client";
+
+const url = "https://mcp.deepwiki.com/mcp";
+const session = await mcpConnect(url);
+for (const tool of await mcpListTools(url, { session })) {
+  console.log(`${tool.name}: ${tool.description ?? ""}`);
+}
+```
+
+The root entry requires `@corbits/oauth-core` as well as `@intx/agent` and
+`@intx/harness`. Install `@corbits/oauth-core@0.3.3` (optional peer `^0.3.3`)
+and `@intx/harness@0.5.0` (optional peer `^0.5.0`).
+`@intx/agent` and `@intx/harness` alone are not enough: importing `mcpTools`
+from `@corbits/mcp` loads `@corbits/oauth-core`. After those peers are
+installed, the root entry discovers each server and builds one Interchange
+tool per remote tool:
+
+```ts
+import { mcpTools } from "@corbits/mcp";
+
+const factory = await mcpTools({
+  servers: [{ name: "deepwiki", url: "https://mcp.deepwiki.com/mcp" }],
+});
 ```
 
+The four entries in the table above are the scoped role entries, not the whole
+public surface. The package also exports `.`, `./hub`, `./sidecar-bundle`, and
+`./server/task-store`. This package does not claim full MCP certification and
+does not supply a browser renderer. Legacy sessions are in-memory. The Skills
+consumer declines dynamic manifests.
+
 ## Quickstart
 
 Lists the tools on a public MCP server:
@@ -274,7 +314,7 @@ above still apply, including no deprecated HTTP+SSE transport or SSE resumption.
 - `readCredentialSecret` is now `readCredential`, which returns `{ secret, origin? }`. `discoverMcpServer` takes `credential: { secret, origin? }` instead of `secret`.
 - `mcpInitialize` returns an `McpSession` (`protocolVersion`, `sessionId?`, `serverInfo?`) and sends `notifications/initialized`. Pass it as `{ session }` to `mcpListTools` and `mcpCallTool`; a stateful server needs it.
 - The discovery route refuses plain-http loopback URLs unless `allowLoopback` is set. Handles and server names containing `.`, and catalogs repeating a tool name, are refused. `mcpTools` refuses an empty or repeated server name, and a non-https URL, before any request.
-- The integration baseline is `@intx/agent` 0.5.0 and `@intx/harness` 0.5.0; see package peer ranges.
+- The integration baseline is `@intx/agent` 0.5.0, `@intx/harness` 0.5.0 (peer `^0.5.0`), `@corbits/oauth-core` 0.3.3 (peer `^0.3.3`), and `@corbits/credential-http` 0.1.3 (peer `^0.1.3`).
 - Discovery rejects authorization-server metadata whose `issuer` differs from the one the protected resource names.
 
 ## License