NOMA

NOMA is an open-source, read-only MCP gateway foundation for Korean public data. It is designed to expose carefully bounded public-data capabilities to MCP clients while keeping provider boundaries, licensing, security, and operational behavior explicit.

The repository now contains the M1 public foundation, M2 secret/config runtime, M3 provider applications, the M4 catalog/remote gateway and digest-only key lifecycle, and the M5 setup CLI. The setup CLI configures all four supported clients through a packaged stdio bridge; it does not claim native remote/OAuth setup or external hosted deployment.

M7 adds executable release-acceptance harnesses for clean-clone installation, self-hosted Streamable HTTP, security cases, Compose in CI, and an explicitly authenticated hosted endpoint. Hosted/public registry verification remains an external gate when its endpoint and access key are not available locally. The local validator reports only localBlockingContractViolations; it does not inspect GitHub issues or claim the final blocking-issues count is zero.

Principles

• Read-only by contract: no mutation or destructive provider operation is part of the public gateway surface.

• Public boundary first: only clearly publishable material belongs here.

• Explicit provider isolation: each future provider is independently bounded, documented, and testable.

• Honest status: a directory or document boundary is not presented as a working provider or hosted service.

Related MCP server: io.github.raheb77/saudi-open-data-mcp

Repository map

Development

Requirements: Node.js 20 or newer and npm 10 or newer.

npm ci
npm run lint
npm run build
npm test
npm run verify:readonly
npm run verify:secrets
node scripts/validate-workflows.mjs
node scripts/validate-distribution.mjs
node scripts/contract-check.mjs
node scripts/validate-repository.mjs
git diff --check
npm audit --audit-level=high
npm run verify:m7
npm run verify:e2e:self-host
npm run verify:fresh

The commands validate the repository foundation, provider contracts, runtime tests, gateway authentication, bounded shutdown, and secret/read-only boundaries. Hosted deployment and external production connectivity are not claimed by these local checks. npm run verify:e2e:hosted requires an operator-provided HTTPS endpoint and access key through environment variables.

Contributing and security

Read CONTRIBUTING.md before opening a change. Security reports belong in the process described by SECURITY.md. All contributors are expected to follow CODE_OF_CONDUCT.md.

License

NOMA is available under the Apache License 2.0. Attribution and third-party obligations are described in NOTICE and THIRD_PARTY_NOTICES.md.