mirror of
https://github.com/hanzo-apps/world.git
synced 2026-10-30 14:53:09 +00:00
zeekayandHanzo Dev
95d5c9dc05
Clean-room MCP apps surface for Hanzo World — a thin, read-only projection of the existing public /v1/world/* routes. Ideas-only from the upstream study; no code copied. - internal/world/mcp: JSON-RPC 2.0 over streamable HTTP. 7 tools (world_brief, country_instability, model_history, market_quotes, chain_status, traffic_map, feeds) each dispatched IN-PROCESS through the same world mux via an httptest recorder — one impl per data path, the model.Engine's unexported handlers reached through the mux composition point, zero edits to existing handlers. - Two MCP apps (ui:// resources): world-brief + market-radar. resources/read returns a DATA-FREE static HTML shell (text/html;profile=mcp-app, strict CSP, textContent-only, no innerHTML) that receives data later via a tools/call over the host postMessage bridge (quota-safe two-phase). - Discovery: root server.json (MCP registry manifest) + public/.well-known/ mcp/server-card.json (tool + app inventory), both generated by cmd/gencard and digest-stable like the agent-skills index. - feeds tool exposes a curated category enum (never raw URLs) over allowlisted RSS hosts — no SSRF surface. - Anonymous public access; gate() attachment point noted per the internal/world/model gate() pattern for later pro-tier gating. Tests: JSON-RPC initialize/tools.list/tools.call/resources round-trip over live wiring, server-card + server.json drift guards, shell digest pins, and a data-free/no-innerHTML shell-safety grep. Verified end-to-end against the compiled binary with the official @modelcontextprotocol/inspector CLI. Co-authored-by: Hanzo Dev <[email protected]>