Draft: Modernize exmxc MCP implementation (codex/exmxc-mcp-modernization)

[Trailgenic]

Motivation

• Modernize the exmxc MCP implementation to the TrailGenic v1.4 architecture: canonical registry-driven tools/resources, official MCP protocol versions, hardened ADS and audit routes, truthful machine documents, and CI/Workers runtime tests.
• Move metadata, OpenAPI parameters, discovery outputs, SDK registration inputs and resource descriptors to a single registry (lib/registry.js) so generated surfaces cannot drift from the canonical source.

Description

• Canonicalization: bumped BUILD.version to 2.3.0 and BUILD.released to 2026-07-15, added MCP_PROTOCOL_VERSIONS, moved per-tool OpenAPI parameter metadata into lib/registry.js, and introduced SCHEMA_RESOURCES and MCP_RESOURCES derived from DATASETS and registry entries; derived counts: 10 tools, 12 MCP resources.
• Transport & request policies: replaced the handwritten MCP handler surface in worker.js with a Workers-native MCP route implementing Accept/Content-Type/Origin/CORS rules, per-request protocol-version validation, resources/list and resources/read support, tools/list/tools/call behavior driven by the registry, structuredContent emission only for protocol-valid objects, and route-class cache policies via lib/http.js (no-store, no-cache, controlled public`).
• ADS & Audit hardening: added POST /api/ai-jobs-signal bearer auth using ADS_SIGNAL_KEY, strict POST body checks and no-store caching for paid paths, and introduced validateAuditTarget() with HTTPS-only, no-credentials, no IP-literal, no-localhost/special-hosts and length checks before calling the upstream audit service in lib/queries.js.
• Package, CI & tests: added package.json (type: "module") and placeholder package-lock.json with dependencies: @modelcontextprotocol/sdk@^1.26.0, agents@^0.0.117, ajv@^8.17.1, zod@^3.25.76; devDeps: @cloudflare/vitest-pool-workers@^0.8.69, vitest@^3.2.4, wrangler@^4.24.3. Added scripts: lint, test, test:workers, validate:json, registry:check, deploy:dry-run; added Workers live acceptance and registry-check scripts and GitHub workflows (.github/workflows/ci.yml and updated deploy.yml) that gate deploy on verification.
• Documents & machine-docs: updated README, SYSTEM_MAP, registry packet, and submission files to reflect the MCP modernization, ADS auth requirement, audit upstream security dependency, and structuredContent compatibility implications.
• Safety note / incomplete SDK integration: dependency declarations added but the official MCP SDK (McpServer / createMcpHandler) was not wired into the running handler in this environment; the Worker-native handler implements the specified protocol behavior, but the final integration with the official Cloudflare MCP SDK must be completed and verified in a Node-enabled environment before merge.
• Files changed (high level): lib/registry.js, worker.js, lib/http.js, lib/queries.js, package.json, package-lock.json, .github/workflows/ci.yml, .github/workflows/deploy.yml, scripts/* (live-acceptance, build/check scripts), tests/registry.test.mjs, registry/* (packet/server/SUBMISSION), README.md, SYSTEM_MAP.md.
• Compatibility & preservation: no substantive dataset payloads were altered; workers/root-discovery/ remained untouched; no secrets (e.g. ANTHROPIC_API_KEY or ADS_SIGNAL_KEY) were placed in source files beyond usage of binding names.

Testing

• Static/source checks: repository-level source-scan for retired transport terms and secret assignments (scripts/source-check.mjs / rg) passed locally (no occurrences of retired terms or embedded secret assignments in non-exempt paths).
• Test artifacts added but not executed: unit and Workers-runtime tests and registry drift checks were added (tests/registry.test.mjs, scripts/check-registry-packet.mjs, vitest config), but the Node/npm-based verification battery could not be executed here because the environment lacked npm/node and outbound GitHub access. The CI workflows are present and will run these scripts when executed on GitHub Actions.
• Attempts that failed in this environment: npm ci, npm run lint, npm test, npm run test:workers, npm run validate:json, npm run registry:check, and npm run deploy:dry-run could not run because /bin/bash: line 1: npm: command not found in this container; network calls to GitHub API (preflight to verify PRs Update name in Wrangler configuration file to match deployed Worker #3, Add ENTITY, Four Forces exposure, and AI Power Index datasets plus SYSTEM_MAP.md #9, Add AI Power datasets, entity/four-forces datasets, and system map #10, Add Four Forces exposure and AI Power Index dataset v1 #20 and git fetch origin) failed with CONNECT tunnel failed, response 403 so preflight PR checks and pushing/creating a real Draft PR could not be completed here.

Next steps for reviewers / merge preparation

• In a Node-enabled environment with GitHub access: run npm install to produce a real lockfile, then run the full verification battery: npm ci, npm run lint, npm test, npm run test:workers, npm run validate:json, npm run registry:check, npm run deploy:dry-run and inspect GitHub Actions CI on the pushed Draft PR head.
• Complete official SDK integration: install dependencies and wire McpServer from @modelcontextprotocol/sdk and createMcpHandler from the Cloudflare agents/mcp package per the public SDK lifecycle; remove any placeholder Worker-native transport only after the SDK integration is validated.
• The PR intentionally documents the remaining limitations (SDK wiring, lockfile regeneration, and CI execution) so they can be resolved in this branch before merge.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
exmxc-workers	Ready	Preview, Comment	Jul 16, 2026 12:33am

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	exmxc-workers	940adb7	Jul 16 2026, 12:33 AM