src/zap.ts is a consumer seat on the unix socket of whichever process the
lock elected: zapd has no JS or wasm build, so this runtime joins as
mcp/hanzo-<pid> and never stands for router. browser and cdp carry Python's
action names, parameters and extension methods; headless Playwright covers
the core, navigation and tabs when no browser is registered. The test runs
PyPI zapd as the router in another process, with a fake extension.
@hanzo/mcp 2.4.12
--core-only set enableCore, which the unified surface ignores; it now offers the core group, and serve and list-tools read their flags through one function. list-tools printed four headers for tools that no longer exist and none of the 22; it now lists each tool under its group. install --claude-code wrote ~/.config/claude-code/mcp.json, which Claude Code does not read; it now runs claude mcp add --scope user. The smoke checks all three against dist/cli.js.
Co-authored-by: Hanzo Dev <[email protected]>
Three runtimes carry the file and each was refreshed on its own, which is how
they come to disagree. One run writes them all; a sibling repo that is not
checked out is skipped rather than created.
The seven resources this offered had drifted from the fleet it names: paas is
platform, storage is s3, auth folded into iam, and iam alone carries 97
operations against the handful the hand-written tool reached. It also dialled
four hosts for one API.
The names come from cloud's typed operations now, so this client cannot come to
disagree with the API about what exists. The withholding rule is asked of cloud
rather than restated here — a client deriving its set from the raw catalog offers
what the fleet refuses.
The default surface is unchanged at 22 tools; the fleet sits behind hanzo, whose
resource enum is derived rather than listed.
CI:
- Drop GitHub-hosted ubuntu/macOS/Windows runners per org policy
(NO GITHUB BUILDERS). All jobs now run on [self-hosted, amd-medium]
or [self-hosted, arm-medium] — native amd64 + arm64 in parallel,
no QEMU.
- 6 jobs: build/test × {amd64, arm64}, integration × {amd64, arm64},
e2e-against-published × {amd64, arm64}, security audit.
Integration test (scripts/smoke-mcp.mjs, also 'npm run smoke'):
- Replaced the initialize-only probe with a 6-step real-tool roundtrip
on one stdio session: initialize → tools/list → tools/call fs.read
on a real on-disk probe → tools/call fs.list → resources/list →
resources/read. Validates serverInfo, tool catalog membership, and
payload bodies. Local run: 6/6 pass in <1s.
This is the actual contract Claude Desktop / Code / Cursor use. If
this passes on amd64 + arm64 native, the package works.
Catches the class of bug that shipped in 2.4.1 (silent stdio hang because
'serve' was being routed to the wrong binary).
- .github/workflows/ci.yml: matrix on ubuntu / macOS / Windows × Node 20/22.
Adds a 'smoke' job that runs scripts/smoke-mcp.mjs (spawn cli.js, send
initialize, require serverInfo.name === hanzo-mcp within 20 s) on every
supported OS, and an 'e2e-npx' job that does the same against the
*published* npm package via the exact npx invocation Claude Desktop /
Claude Code generate. This is what was missing — local builds were fine,
but the published-bin routing was broken.
- scripts/smoke-mcp.mjs: cross-platform MCP-protocol smoke test, also
exposed as 'npm run smoke'.
- src/cli.ts: always-on startup banner now includes node version + platform
so support logs are useful by default. HANZO_MCP_DEBUG=1 adds cwd,
resolved CLI path, argv, and PATH prefix — surfaces 'wrong binary
shadowing hanzo-mcp' bugs immediately.
- README.md: Troubleshooting section with stdio-handshake test command,
HANZO_MCP_DEBUG setup, log paths for macOS / Windows, and the rationale
for the '--package=' arg form.
## Core Implementation
- Unified search engine with strategy pattern for extensible search types
- Full OpenAI MCP specification compliance for search and fetch tools
- Multi-modal search strategies: Symbol, AST, Vector, Text, and File search
- Automatic strategy selection based on query characteristics
## Security & Remote Access
- Secure ngrok tunnel integration with automatic detection
- Multi-method authentication (Bearer token, API keys, JWT)
- Post-quantum TLS configuration support
- Rate limiting and CORS protection
- Access logging and monitoring
- Only exposes files when ngrok credentials are present
## Testing & CI
- 102 tests with 85% coverage on critical paths
- GitHub Actions CI workflow for automated testing
- Node.js 18.x and 20.x compatibility testing
- Coverage reporting to Codecov
- Security audit checks
## Documentation
- Comprehensive documentation in LLM.md
- Security guide in docs/SECURITY.md
- .npmrc excluded from repository for security
This implementation provides a production-ready search system for AI tools like ChatGPT and Claude Desktop.
zeekay
