feat(mcp): add npm wrapper and MCP Registry metadata

[bomly-guy]

Unblocks L3-1 in the marketing listings tracker: publishing Bomly to the official MCP Registry.

Why

The registry accepts only npm, PyPI, NuGet, Cargo, OCI, or MCPB packages. Bomly ships a Go binary, so there was nothing to point a registry entry at. The same gap blocks the community MCP directories (mcpservers.org, PulseMCP, Glama, MCP.so), which all expect a one-line npx install.

Of the eligible paths, npm gives the best install story for MCP clients. OCI would force users to volume-mount the project being scanned; MCPB would mean one bundle carrying every platform's binary, with narrower client support.

What

• npm/ — a thin bomly-mcp package, zero dependencies.
  • scripts/postinstall.js downloads bomly_<version>_<goos>_<goarch>.{tar.gz,zip} from the matching release, verifies it against that release's SHA256SUMS, and unpacks the binary into vendor/. A mismatch fails the install — there is no unverified fallback.
  • bin/bomly-mcp.js execs bomly mcp serve with stdio inherited and forwards SIGINT/SIGTERM/SIGHUP, so stdout stays pure JSON-RPC and the child never orphans.
  • BOMLY_MCP_VERSION pins a version; BOMLY_MCP_SKIP_DOWNLOAD=1 skips the download for lint/CI installs.
• server.json — registry metadata, schema 2025-12-11, naming io.github.bomly-dev/bomly-cli and the bomly-mcp npm package.
• release.yml — a new mcp-registry job that publishes npm, waits for the version to be resolvable, then runs mcp-publisher publish.
• auto-version.yml — bumps the version in npm/package.json and server.json alongside cmd/bomly/main.go.
• Docs: an npx path in docs/MCP.md and the README's AI-agents section.

Ordering, and why it matters

mcp-registry runs needs: publish. Releases stay drafts until the publish job finalizes them, and draft-release assets are not publicly downloadable — so publishing npm any earlier would ship a package whose postinstall 404s. The job also waits for npm's CDN before calling mcp-publisher, because the registry verifies ownership by fetching the package.

Before this can run — needs you

The job is gated on vars.PUBLISH_MCP_REGISTRY == 'true' and does nothing until you enable it:

gh secret set NPM_TOKEN -R bomly-dev/bomly-cli
gh variable set PUBLISH_MCP_REGISTRY -R bomly-dev/bomly-cli --body true

Registry auth is GitHub OIDC, so it needs no secret of its own; the io.github.bomly-dev/* namespace comes from this repo's identity. bomly-mcp is unclaimed on npm.

Verified locally

• npm pack, then a clean install of the tarball into a scratch project: the binary downloaded, checksum verified, and bomly version reported 0.20.1.
• Drove a real MCP handshake through ./node_modules/.bin/bomly-mcp: initialize returned serverInfo {"name":"bomly","version":"0.20.1"}, tools/list returned all four tools, and a bomly_scan call returned a schema_version: "mcp/1" result. stdout carried only JSON-RPC; the banner stayed on stderr.
• server.json validates against the registry's 2025-12-11 schema (ajv).
• make generate produces no drift.

Not yet exercised: the mcp-registry job itself, which cannot run until the secret and variable above exist.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a0a017ed-046e-437f-bb31-88aa03e65cc1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/mcp-registry-npm-wrapper

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Bomly Diff Summary

Compared 961692bd84d2c3b8a090e7aeed373c8edc0a6fc3 to 04a9b2e2578aff4ccd5072ba01c9a606275d9feb.

Overview

Status	Manifests	Dependencies	Findings	Duration
✅ Pass	+0 / ~0 / -0	+0 / ~0 / -0	0 introduced / 0 persisted / 0 resolved	1m 4s

Dependency Changes

✅ No dependency changes.

Vulnerabilities

✅ No vulnerability changes.

License Changes

✅ No license changes.

Project Posture

✅ No project posture changes (--matchers +scorecard was not selected).

Policy Findings

✅ No policy differences were identified.