Owner snapshots

The gap this fills

The directory's prober connects anonymously. For a server that requires authentication it can verify the handshake, the auth model, and uptime — but it can never list your tools, so your listing's contract changelog stays empty exactly where your users would want it.

The fix keeps custody where it belongs: you snapshot the contract on your own infrastructure, with your own credentials, and push the result into the listing's public history. The directory never holds your keys.

Requirements

• Your listing is claimed and verified on your account
• An API key from the site — Settings → API keys (oat_…)
• mcpi-cli — prebuilt binaries ship with every release

Push from CI

mcpi-cli publish stdio:node ./server.js \
  --listing <slug> \
  --api-key $MCPI_API_KEY

The source is any form snapshot accepts — stdio:… spawns your server locally (credentials via its environment), an https://… URL dials it live with --header "Authorization: Bearer …". Run it in the pipeline that deploys your server, after the deploy step, and the listing's changelog tracks every release.

Pushes are digest-gated: an unchanged contract records nothing, so pushing on every deploy is safe and idempotent.