[TheGreatAxios]

Summary

• Describe @corbits/mcp as an MCP client, a stateless server, and an Interchange bridge.
• Point install lines at @corbits/oauth-core@0.3.3 and @corbits/credential-http@0.1.3, and show the neutral @corbits/mcp/client list-tools import plus the peer-backed mcpTools import.

Closes #29

[corbits-triage]

Triage: Pass

No changes needed from you. A maintainer will review this pull request.

Waiting on a maintainer to approve: approve, request review.

[TheGreatAxios]

Review · Request changes

Points agents at the 0.4.0 client, server, and Interchange entries. The new root mcpTools quickstart does not match this branch.

Findings

• README.md:92 — the quickstart says that after only @intx/agent and @intx/harness, import { mcpTools } from "@corbits/mcp" works. The root barrel re-exports src/oauth-discovery.ts and src/auth/login.ts, which import @corbits/oauth-core. bun build src/index.ts --target=bun --packages=external still emits that import. Loading the graph with stubs for @intx/agent, arktype, and ajv and no oauth-core exited 1 with ERR_MODULE_NOT_FOUND. docs/migration.md and e2e/package.test.ts:63 already require oauth-core for the historical root. The client snippet at README.md:82 does match mcpConnect / mcpListTools on @corbits/mcp/client.

• README.md:58 and docs/public-api.md:35 — both install @corbits/oauth-core@0.3.3. This branch’s devDependency and the e2e pin are 0.3.0, and the peer is ^0.3.0 (package.json:105). The same public-api page still says the pinned development dependency is 0.3.0. ^0.3.0 can install 0.3.3, but that is not the pin this branch tests.

• README.md:70 — the hub block installs @corbits/credential-http@0.1.3. This branch pins devDependency 0.1.0 and peers ^0.1.0. docs/public-api.md:38 still says 0.1.0 does not resolve with the 0.5 baseline and that no release number is known.

• README.md:103 — “The four entries in the table above are the public surface.” package.json also exports ., ./sidecar-bundle, ./hub, and ./server/task-store. docs/public-api.md already lists ./server/task-store and the root as public API, and this section imports the root.

@corbits/mcp@0.4.0, the client { session } options, mcpTools({ servers: [{ name, url }] }), and the @intx/agent@0.5.0 / @intx/harness@0.5.0 pins do match this branch.

[TheGreatAxios]

Review · Follow-up

The quickstart now matches this branch.

The root mcpTools snippet still imports from @corbits/mcp and now tells the agent to install @corbits/oauth-core@0.3.0 (peer ^0.3.0). README and docs/public-api.md no longer pin 0.3.3 or credential-http@0.1.3. The public-surface sentence also names ., ./hub, ./sidecar-bundle, and ./server/task-store.

Pushed as 9a9b1db (docs: align quickstart pins with declared peers). Docs only, so this did not get a second code review.

[TheGreatAxios]

Included in the 0.4.1 release, with install pins updated to oauth-core ^0.3.3, harness ^0.5.0, and credential-http ^0.1.3. Do not merge this PR separately. See the release/0.4.1 PR that closes #32.

[TheGreatAxios]

Included in #33, with quickstart pins updated to the 0.4.1 peers. Do not merge this pull request separately.

[TheGreatAxios]

Superseded by the 0.4.1 release: #33