Nymrel MCP Hub

A dual-engine Model Context Protocol server exposing 14 Nymrel tools, 3 resources, and 3 prompt templates through TypeScript/Node.js and Python stdio entry points.

The repository supports the modern MCP 2026-07-28 request model while retaining initialize-era compatibility through 2025-11-25. It does not currently claim a hosted transport or verified npm/PyPI publication.

Distribution status

Until an npm or PyPI receipt is independently verified:

• do not use npx @nymrel/mcp-hub as a documented installation path;

• do not use pip install nymrel-mcp-hub as a documented installation path;

• run the server from a pinned source checkout using the instructions below;

• treat a local build, GitHub artifact, tag, or workflow result as distinct from registry publication.

Publishing, releasing, tagging, and trusted-publisher configuration are intentionally outside this documentation correction.

Run from source

TypeScript / Node.js

Requirements: Node.js 22 or 24 and Corepack.

git clone https://github.com/nymrel/nymrel-mcp-hub.git
cd nymrel-mcp-hub
corepack npm@12.0.2 ci
corepack npm@12.0.2 run build
node ./bin/mcp-server.js --help
node ./bin/mcp-server.js --stdio

Point an MCP client at the built source checkout with an absolute path:

{
  "mcpServers": {
    "nymrel": {
      "command": "node",
      "args": [
        "/absolute/path/to/nymrel-mcp-hub/bin/mcp-server.js",
        "--stdio"
      ]
    }
  }
}

The Node entry point imports compiled files from dist/, so run the build before starting the server.

Python

Requirements: Python 3.11 through 3.14.

git clone https://github.com/nymrel/nymrel-mcp-hub.git
cd nymrel-mcp-hub
python -m venv .venv
# macOS/Linux: source .venv/bin/activate
# Windows PowerShell: .venv\Scripts\Activate.ps1
python -m pip install --editable .
nymrel-mcp --help
nymrel-mcp --stdio

For an MCP client, use the absolute path to the virtual environment's nymrel-mcp executable. On Windows, that executable is under .venv\Scripts; on macOS and Linux, it is under .venv/bin.

Protocol contract

The stdio engines support two MCP behavior families without changing the exposed tool, resource, or prompt catalog.

Modern requests

• Protocol revision: 2026-07-28.

• Discovery method: server/discover.

• Each modern request carries protocol and client capability metadata in params._meta.

• Successful results include resultType: "complete" plus server identity metadata.

• Discovery and static list results may include bounded public cache hints.

Initialize-era compatibility

Supported initialize-era revisions are:

• 2024-10-07

• 2024-11-05

• 2025-03-26

• 2025-06-18

• 2025-11-25

Legacy responses remain free of modern-only fields. A modern revision offered through initialize receives the preferred legacy counteroffer rather than a false modern handshake.

Fail-closed behavior

• Unsupported modern revisions return MCP error -32022 with the supported revision.

• Missing or malformed modern metadata returns -32602.

• JSON-RPC notifications remain silent.

• ping and notifications/initialized remain initialize-era behavior.

• Modern list-change subscriptions are not advertised because this server does not implement subscriptions/listen.

Exposed tools

The hub exposes Nymrel-oriented tools through one MCP surface. Repository names below identify the source project represented by each tool; they are not registry-publication claims.

Resources

• nymrel://status — server identity, engine status, tool count, and supported protocol revisions.

• nymrel://ecosystem — catalog of the Nymrel project references represented by the hub.

• nymrel://llms-manifest — machine-readable usage and trust guidance.

Prompt templates

• audit-website-ucp — guided AI commerce readiness audit.

• secure-agent-command — command-safety review using Nymrel guardrail tools.

• init-two-seat-mission — two-seat Command Studio setup.

Security boundary

The hub exposes application-level inspection, proof, lease, and credential-pattern tools. These tools do not replace operating-system isolation, network enforcement, independent authorization, credential rotation, or sandboxing. Consumers must apply least privilege and validate tool results at the actual enforcement point.

See SECURITY.md for responsible disclosure and supply-chain controls.

Validation

The repository pins npm 12.0.2 and targets Node.js 22/24 plus Python 3.11-3.14. Both package manifests declare no runtime dependencies.

Node.js

corepack npm@12.0.2 ci
corepack npm@12.0.2 run verify
corepack npm@12.0.2 audit --audit-level=high
corepack npm@12.0.2 audit --omit=dev --audit-level=high
corepack npm@12.0.2 install-scripts ls

The verification contract covers toolchain pins, TypeScript compilation, protocol tests, CI-policy tests, and the npm package allowlist.

Python

python -m pip install --requirement requirements-dev.txt
python -m pip install --editable .
python -m pip check
python -m ruff check python tests
python -m bandit -q -r python/nymrel_mcp_hub
python -m pytest -q
python -m pip uninstall --yes nymrel-mcp-hub
python -m pip_audit --strict
python -m build --outdir dist-py
python -m twine check dist-py/*

Local validation proves a source candidate; it does not prove a hosted check or registry publication.

Contributing

See CONTRIBUTING.md. Protocol changes must preserve TypeScript/Python parity and prove both modern and initialize-era behavior. Release or publication work requires a separate operator decision.

License and organization

• Brand: Nymrel

• Website: https://nymrel.com

• Contact: contact@nymrel.com

• Legal entity: JalenBuilds LLC

• License: MIT — see LICENSE