feat: add csoai-gspc-mcp worker with public initialize - #29
Draft
CSOAI-ORG wants to merge 2 commits into
Draft
Conversation
Add the GSPC measurement MCP worker from feat-work branch. This worker handles initialize and public board tools (measure, verify, jail-probe) without requiring Authorization headers. - initialize: responds without auth (fixes Smithery scan failure) - tools/list: lists available tools without auth - verify: free, anonymous, no trust (stays loginless) - measure + jail-probe: return contracts, no auth gate The registry/server.json already references this worker path. Co-authored-by: Nicholas Templeman <nicholas@csoai.org>
CSOAI-ORG
added a commit
that referenced
this pull request
Aug 23, 2026
Retarget csoai.org/mcp* and www.csoai.org/mcp* from sov-mcp-gateway (500 kind=no-token) to the public-friendly csoai-gspc-mcp worker. Changes: - workers/csoai-gspc-mcp: worker with routes for csoai.org/mcp* - .well-known/mcp.json: reference live MCP server - .well-known/mcp/server-card.json: Smithery/MCP discovery card The worker handles public initialize + tools/list without Authorization. Free verify stays loginless. No key required in Smithery. No SOV* branding. Deploy requires: cd workers/csoai-gspc-mcp && npx wrangler deploy GHA workflow needs CF_ACCOUNT_ID + CF_API_TOKEN secrets. Supersedes PR #29 (HOLD) which added the worker stub without routes. Co-authored-by: Cursor Agent <cursoragent@cursor.com>
CSOAI-ORG
pushed a commit
that referenced
this pull request
Aug 26, 2026
…llel agent) + sigil #66 + keystone #29 ALIGN + REVISE + GO: - ALIGN: 14 E2E failures are all parallel agent work (auth, sbt, payments, chronicle, storage, a2a, meok_ui, cross_service) - NOT JEEVES - csoai_monetization: 54/54 pass intact - SHIP: 5 insurance specialty prospects (Hiscox UK, Travelers US, Chubb global, Allianz DE, AXA FR) - SHIP: queue 321 → 326 - ACT: Day 30 seal + sigil #66 + keystone #29 T-19 days to Article 50. 28 verticals, 145+ organisations, 326-queue. 221 pages, 28 API endpoints, 620 sigils, 29 keystones. Sigil #66: digest=858fb2b9066038a7
measure returns a contract; verify is card-family scoped. Quote living GET, not frozen 13/14.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
POST
https://csoai.org/mcpinitialize with no Authorization header returns HTTP 500:{ "kind": "no-token", "message": "Missing or non-bearer Authorization header." }Public board tools must initialize without a bearer. Verify stays free and loginless. No key in Smithery.
Change
One change onto main: add
workers/csoai-gspc-mcpso public initialize and public board tools succeed with no Authorization.Not a merge of the whole feat-work branch.
Files
workers/csoai-gspc-mcp/.gitignoreworkers/csoai-gspc-mcp/wrangler.tomlworkers/csoai-gspc-mcp/src/index.jsCode only. No wrangler. Sit merge.