[P1] Reconcile MCP package, Registry, Smithery, and client setup with #433 contract

[replynodes-ai]

Parent: replynodes-fetcher#433

Goal

Reconcile the public MCP package and distribution metadata with the final ReplyNodes MCP contract now published in replynodes-fetcher origin/main at 008a23ec196efd50e3ab2ede0cf244c258999720 (merged PR #478).

Canonical contract

• MCP endpoint: https://mcp.replynodes.com/mcp
• OAuth issuer: https://auth.replynodes.com
• Interactive auth: native Better Auth MCP OAuth, scope mcp:read
• Headless/manual auth: ReplyNodes rn_test_* / rn_live_* API keys
• Organization is resolved from the authenticated identity/key; clients do not send an organization id
• Read-only public data only
• No x402, accountless, anonymous, wallet, or pay-per-call MCP claims

Surfaces owned by this repository

Audit and, where needed, update the source-of-truth artifacts without inventing package endpoints or claiming external publication:

• README.md: native remote setup, stdio bridge setup, auth links, client-specific instructions, and remove the explanatory api.replynodes.com/mcp relationship text from public MCP guidance.
• server.json: keep the actual published package/version and canonical remote endpoint; document only supported authentication metadata. Use the official registry publisher workflow for any Registry release.
• package.json / npm bridge (bin/cli.js): keep package metadata and defaults truthful; preserve the API-key bridge, and make the native OAuth/direct-remote path clear without pretending the bridge itself performs browser OAuth.
• client setup docs in this repository: Claude/Claude Code, Cursor, Codex, Windsurf, OpenClaw, and generic remote-MCP instructions must link to the canonical docs and distinguish native OAuth from API-key configuration.

External listing surfaces

• Official MCP Registry: current public latest record is com.replynodes/mcp v1.0.3 at https://registry.modelcontextprotocol.io/v0.1/servers/com.replynodes%2Fmcp/versions/latest, with remote https://mcp.replynodes.com/mcp and Bearer-key metadata. Do not claim a new Registry publication unless the official owner workflow returns a publish handle and a re-fetch verifies it.
• Smithery: the public listing is currently reachable at https://smithery.ai/servers/replynodes/mcp and exposes a Smithery proxy plus 51 read-only tools. Verify its displayed auth/setup metadata against the canonical contract; do not use the old @replynodes/mcp URL as evidence of a listing. Existing history: issue [MCP-DIST-003] Publish ReplyNodes MCP to Smithery #12 and PR feat(mcp-dist): make ReplyNodes submit-ready for Smithery + correct stale listing claim #20.
• Other directories/marketplaces: record verified URLs and blockers only. Do not claim a listing or submission from a repository artifact alone.

Evidence captured for this handoff

• Source repo replynodes-mcp default branch is master, current fetched tip 3a5445497cb396feb13f9c638e6e315b4e1cdc40.
• Current server.json and npm package metadata are version 0.1.3 and point their remote at https://mcp.replynodes.com/mcp.
• Current README still uses the legacy https://replynodes.com/auth.md credential flow and contains public explanatory text naming https://api.replynodes.com/mcp; it does not document the Better Auth issuer/native OAuth contract.
• Current Smithery markdown at /servers/replynodes/mcp advertises https://mcp--replynodes.run.tools, apiKey query configuration, and the stale replynodes.com/auth.md claim.

Acceptance

• README/server.json/npm bridge/client setup are consistent with the canonical contract.
• No public MCP guidance advertises api.replynodes.com/mcp, x402, accountless access, wallet flows, or pay-per-call billing.
• API keys remain first-class and the stdio bridge remains truthful.
• Native Better Auth MCP OAuth is documented as the interactive path, with https://auth.replynodes.com and mcp:read.
• Registry/Smithery/listing state is reported only from live evidence and official publication results.
• Link the implementation PR and exact verification evidence back to replynodes-fetcher#433.

Non-goals

Do not modify replynodes-fetcher, replynodes-site, or any external Registry/Smithery account from this issue. Do not invent a package endpoint, OAuth client registration flow, organization-id parameter, or listing state.

[replynodes-ai]

Implementation PR: #26 (#26). Verification on commit d4a3e4d: node test-cli-secret-safe.mjs PASS; official MCP server.json schema validation PASS; npm pack --dry-run PASS; version consistency, secret scan, prohibited-contract scan, and git diff --check PASS. No npm/Registry/Smithery publication performed.

[replynodes-ai]

Implemented and merged via PR #26 at b140eac. Canonical endpoint/OAuth/API-key contract and truthful stdio bridge are aligned. Smithery live stale metadata is explicitly recorded as external/owner-gated; no publication was claimed.