Open-source operations checklist

The repository is public. Use this checklist to finish and periodically audit the operational safeguards that remain after public launch.

Repository content

Review the full Git history, current files, GitHub Actions logs, releases, issue/PR bodies, and npm metadata for credentials, private URLs, personal data, and internal-only material.
Verify that LICENSE, README.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, and SUPPORT.md are present and current on main.
Verify issue forms and the pull-request template render correctly on GitHub.
Confirm the package name, license, copyright owner, and public documentation are intentional.

Repository is public.
Enable private vulnerability reporting and confirm the Security tab accepts private reports. Until this is complete, SECURITY.md must not claim a working private channel.
Publish and monitor a private Code of Conduct reporting contact.
Confirm Issues are enabled; enable Discussions only if maintainers commit to monitoring it.
Add repository topics: model-context-protocol, mcp, typescript, decorators, zod, and streamable-http.
Verify squash merging and automatic deletion of merged head branches are enabled.
Protect main: verify that the required verify status check, up-to-date branch requirement, approval rules, and direct-push block are all enforced. Record the verification date and settings evidence before marking complete.

Run npm ci, npm run lint, npm run typecheck, npm test, npm run build, npm run verify:package, npm run verify:publish, npm run audit:prod, and git diff --check.
Complete npm release readiness separately before any new package publication.
Publish a maintainer policy for security/CODE OF CONDUCT reporting contacts, triage, review turnaround, and supported versions once a regular release cadence is chosen.