---

Who this is for

• Tool authors in mcp-tool-shop-org who want their project listed, spotlighted, and verified.
• Journalists and reviewers looking for press kits with receipt-backed spotlight picks. See the Presskit Handbook.
• Other orgs who want to run the spotlight engine for their own catalog. See Portable Core.

Not for: End users of individual tools -- go to the tool pages instead.

60-Second Quickstart

git clone https://github.com/mcp-tool-shop/mcp-tool-shop.git
cd mcp-tool-shop/site
npm install
npm run dev          # localhost:4321

To add a tool: push a repo to mcp-tool-shop-org, then run Actions > "Sync org metadata". The tool appears on the next deploy.

Featured Tools

• File Compass -- Semantic file search with HNSW indexing and local Ollama embeddings. Multi-language AST chunking, <100ms queries over 10K+ files.
• Tool Compass -- Find MCP tools by describing what you need. 115+ indexed tools, progressive disclosure pattern.
• Soundboard Plugin -- Give Claude Code a voice. 12 voices, emotion-aware speech, multi-speaker dialogue.
• Brain-Dev -- MCP server for code analysis: test generation, security audits, health scoring.
• Comfy-Headless -- Headless ComfyUI with prompt intelligence and video generation.

Proof

Every spotlight pick is backed by receipts, not promises.

• 555 tests (449 unit + 106 invariant), all passing
• Zero runtime deps -- nothing to audit, nothing to break
• Receipt-verified spotlight picks -- every promo week has hashed inputs and a commit SHA (browse receipts)
• Freeze modes -- automation pauses when frozen; humans must intervene (Trust Center)
• Decision drift detection -- week-over-week changes are flagged automatically
• Proven claims -- MarketIR claims are evidence-backed and independently verifiable (view proofs)

Verify any week yourself: visit a spotlight page, copy the commit SHA, checkout that commit, and compare sha256sum on each input file.

Example outputs: trust receipt · drift report · recommendations

Stack

Python · TypeScript · C# · .NET MAUI · WinUI 3
MCP · FastMCP · Ollama · HNSW · CUDA
Windows-first · RTX 5080 · Local-only

Philosophy

Everything runs locally. No cloud dependencies for core functionality. Tools compose through the Model Context Protocol. Append-only where it matters. Accessibility baked in, not bolted on.

Syntropy above all else.

---

Documentation

Doc	Purpose
Quickstart	Zero to trust receipt in 5 minutes (npm package)
Handbook	How the site works, common tasks, glossary
Presskit Handbook	Brand assets, blurbs, verification examples for press
Automation contract	Data ownership, override schema, merge rules
Portable Core	Fork the engine for your own org
Security model	Threat model, sanitization, CI controls
Ops Runbook	Weekly operations, promotion pipeline, error codes
Contributing	Local dev setup, testing

Security & Data Scope

Aspect	Detail
Data touched	GitHub org metadata (via API), tool manifests (JSON), site build output
Data NOT touched	No user data, no analytics, no external tracking services
Permissions	Read: GitHub API (org repos, releases). Write: site data files, build output
Network	GitHub API only — for org metadata sync
Telemetry	None collected or sent

See SECURITY.md and docs/SECURITY-MODEL.md for full details.

Scorecard

Category	Score
A. Security	10
B. Error Handling	10
C. Operator Docs	10
D. Shipping Hygiene	10
E. Identity (soft)	10
Overall	50/50

Full audit: SHIP_GATE.md · SCORECARD.md

Support

• Issues: github.com/mcp-tool-shop/mcp-tool-shop/issues
• Trust verification: Trust Center
• Press inquiries: Presskit Handbook