\n\n
![\"WebMCP](\"public/og-image.svg\")
\n\n### π The Complete Toolkit for Secure AI Agent Integration\n\n**Validate β’ Sign β’ Discover β’ Archive**\n\n[](https://kiarashplusplus.github.io/webmcp-tooling-suite/)\n[](LICENSE)\n\n---\n\n
\n\n| \n\n### π Validator\n**[@25xcodes/llmfeed-validator](https://npmjs.com/package/@25xcodes/llmfeed-validator)**\n\n[](https://npmjs.com/package/@25xcodes/llmfeed-validator)\n[](https://npmjs.com/package/@25xcodes/llmfeed-validator)\n\nValidate LLMFeed structure + **Ed25519 signature verification**\n\n```bash\nnpx @25xcodes/llmfeed-validator example.com\n```\n\n | \n\n\n### βοΈ Signer\n**[@25xcodes/llmfeed-signer](https://npmjs.com/package/@25xcodes/llmfeed-signer)**\n\n[](https://npmjs.com/package/@25xcodes/llmfeed-signer)\n[](https://npmjs.com/package/@25xcodes/llmfeed-signer)\n\nGenerate Ed25519 keys + sign LLMFeed JSON files\n\n```bash\nnpx @25xcodes/llmfeed-signer keygen\nnpx @25xcodes/llmfeed-signer sign feed.json\n```\n\n | \n
\n\n| \n\n### π LLMS.txt Parser\n**[@25xcodes/llmstxt-parser](https://npmjs.com/package/@25xcodes/llmstxt-parser)**\n\n[](https://npmjs.com/package/@25xcodes/llmstxt-parser)\n[](https://npmjs.com/package/@25xcodes/llmstxt-parser)\n\nParse & validate [llms.txt](https://llmstxt.org) files with RAG utilities\n\n```bash\nimport { parseLLMSTxt, validateLLMSTxt } from '@25xcodes/llmstxt-parser'\n```\n\n | \n\n\n### π₯ Health Monitor\n**[@25xcodes/llmfeed-health-monitor](https://npmjs.com/package/@25xcodes/llmfeed-health-monitor)**\n\n[](https://npmjs.com/package/@25xcodes/llmfeed-health-monitor)\n[](https://npmjs.com/package/@25xcodes/llmfeed-health-monitor)\n\nFeed health monitoring, crawling & outreach automation\n\n```bash\nnpx @25xcodes/llmfeed-health-monitor check example.com\n```\n\n | \n
\n\n| \n\n### π€ GitHub Action\n**[kiarashplusplus/webmcp-tooling-suite/packages/github-action](packages/github-action)**\n\n[](https://github.com/kiarashplusplus/FIML)\n\nAutomated CI/CD validation with badge generation\n\n```yaml\n- uses: kiarashplusplus/webmcp-tooling-suite/packages/github-action@v1\n with:\n feed: '.well-known/mcp.llmfeed.json'\n create-badge: 'true'\n```\n\n | \n
\n
\n\n---\n\n## π The Suite\n\nA comprehensive web application for the **Web Model Context Protocol (WebMCP)** and **LLMFeed** ecosystem.\n\n**[β Launch the Suite](https://kiarashplusplus.github.io/webmcp-tooling-suite/)**\n\n---\n\n## Project Summary\n\nThe WebMCP Tooling Suite addresses critical gaps identified in the MCP/WebMCP/LLMFeed ecosystem:\n\n| Gap | Problem | Our Solution |\n|-----|---------|--------------|\n| **Trust Validation** | No automated validator for LLMFeed cryptographic signatures | Full Ed25519 signature verification with public key fetching |\n| **Context Indexing** | Prompt bloat from large tool catalogs degrades LLM performance | RAG-optimized indexing with 50%+ token savings |\n| **Feed Discovery** | Fragmented, manual feed discovery across the web | Universal feed directory with .well-known URI support |\n\n## Features\n\n### Implemented\n\n- **Universal LLMFeed Validator** β Comprehensive validation from URL, file upload, or paste\n - Structural validation (feed_type, metadata, capabilities)\n - JSON Schema conformance checking\n - **Full Ed25519 cryptographic signature verification**\n - Security scoring (0-100) with actionable remediation guidance\n - Signature debugger for troubleshooting failed verifications\n\n- **Feed Discovery & Analysis** β Discover feeds from any URL or domain\n - Auto-detection of `.well-known/mcp.llmfeed.json` paths\n - Capability extraction with JSON-RPC invocation examples\n - Token estimation for context planning\n\n- **Feed Directory** β Centralized, public directory of LLMFeeds\n - \"Top Feeds\" (by capabilities) and \"Latest Published\" sections\n - Scraper-friendly JSON links with data attributes\n - GitHub authentication for publishing (prevents spam)\n - **Curated feeds** from verified WebMCP sites\n\n- **Submit Your Feed** β Self-service feed submission workflow\n - 3-step process: Validate β Sign In β Submit\n - Automatic feed validation with score\n - **Embeddable verification badges** (verified, signed, score)\n - HTML, Markdown, and SVG badge formats\n\n- **Universal Archive** β Versioned feed archival with persistence\n - Timestamped snapshots for any feed URL\n - Version history browsing and comparison\n - Export/restore capabilities\n - Immutable versions for cryptographic trust\n\n- **RAG Indexing Preparation** β Transform feeds for vector databases\n - Structured output optimized for embedding models\n - Token efficiency metrics and savings calculation\n - Export to Pinecone, Weaviate, Chroma-compatible format\n\n## Architecture\n\n```\nβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ\nβ WebMCP Tooling Suite β\nβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ€\nβ ββββββββββββ ββββββββββββ ββββββββββββ ββββββββββββ β\nβ βDirectory β βValidator β βDiscovery β β Archive β β\nβ β β β β β β β β β\nβ β β’ Browse β β β’ Parse β β β’ Fetch β β β’ Store β β\nβ β β’ Search β β β’ Verify β β β’ Analyzeβ β β’ Versionβ β\nβ β β’ Curatedβ β β’ Score β β β’ Inspectβ β β’ Export β β\nβ ββββββββββββ ββββββββββββ ββββββββββββ ββββββββββββ β\nβ β β\nβ ββββββββββββ β\nβ β Submit β β Self-service feed submission + badge generator β\nβ β β’ Submit β β\nβ β β’ Badges β β\nβ ββββββββββββ β\nβ β β\nβ ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β\nβ β Core Library (llmfeed.ts) β β\nβ β β’ Ed25519 verification β’ Schema validation β β\nβ β β’ RAG preparation β’ Token estimation β β\nβ ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β\nβ β β\nβ ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β\nβ β RAG Prep Tool β β\nβ β β Vector-ready embeddings for semantic search β β\nβ ββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β\nβββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ\n```\n\n## Security Model\n\nThe validator implements the full Ed25519 trust verification chain:\n\n```\nFeed β Trust Block β Public Key Hint β Signature Verification\n β β β\n signed_blocks Fetch PEM key Verify against\n enumeration from URL canonical payload\n```\n\n**Signature verification protects against:**\n- Tool Poisoning β Malicious tool definition modifications\n- Tool Shadowing β Fake tools intercepting legitimate calls\n- Supply Chain Attacks β Compromised feed distributions\n\n## Tech Stack\n\n- **Framework**: React 18 + TypeScript + Vite\n- **UI**: Radix UI primitives + Tailwind CSS v4 + shadcn/ui\n- **Storage**: localStorage (default) + GitHub Gist sync (optional)\n- **Auth**: GitHub OAuth (optional, via Cloudflare Worker)\n- **Crypto**: Web Crypto API (native Ed25519)\n- **State**: @tanstack/react-query + localStorage\n\n## Deployment\n\nThis is a fully static site that can be deployed to:\n\n- **GitHub Pages** - Zero configuration needed\n- **Cloudflare Pages** - Connect repo and deploy\n- **Netlify** - Automatic deploys from GitHub\n\n### Optional: GitHub OAuth\n\nFor authenticated publishing to the directory, deploy a Cloudflare Worker:\n\n```bash\n# In a separate worker project\nnpx wrangler init webmcp-auth\n```\n\nSet these environment variables:\n- `VITE_GITHUB_OAUTH_URL` - OAuth initiation endpoint\n- `VITE_GITHUB_TOKEN_URL` - Token exchange endpoint\n\n## Installation\n\n```bash\n# Clone the repository\ngit clone https://github.com/kiarashplusplus/webmcp-tooling-suite.git\ncd webmcp-tooling-suite\n\n# Install dependencies\nnpm install\n\n# Start development server\nnpm run dev\n\n# Build all packages\nnpm run build:packages\n```\n\n## Packages\n\nThe tooling suite includes standalone packages for CI/CD integration:\n\n### @25xcodes/llmfeed-validator (CLI)\n\nValidate LLMFeed files with full Ed25519 signature verification.\n\n```bash\nnpm install -g @25xcodes/llmfeed-validator\n\nllmfeed-validate https://25x.codes/.well-known/mcp.llmfeed.json\nllmfeed-validate ./feed.json --verbose --json\n```\n\n### @25xcodes/llmfeed-signer (CLI)\n\nGenerate Ed25519 keypairs and sign LLMFeed files.\n\n```bash\nnpm install -g @25xcodes/llmfeed-signer\n\nllmfeed-sign keygen -o ./keys -n mysite\nllmfeed-sign sign feed.json --key ./keys/mysite.private.pem \\\n --public-url https://example.com/.well-known/public.pem\n```\n\n### @25xcodes/llmfeed-action (GitHub Action)\n\nGitHub Action for automated feed validation in CI/CD pipelines with dynamic badge generation.\n\n```yaml\n# .github/workflows/validate-feed.yml\nname: Validate LLMFeed\non:\n push:\n paths: ['**/*.llmfeed.json']\n\njobs:\n validate:\n runs-on: ubuntu-latest\n permissions:\n contents: write\n steps:\n - uses: actions/checkout@v4\n - uses: kiarashplusplus/webmcp-tooling-suite/packages/github-action@v1\n with:\n feed: '.well-known/mcp.llmfeed.json'\n skip-signature: 'true'\n create-badge: 'true'\n - name: Commit badge\n run: |\n git config user.name \"github-actions[bot]\"\n git config user.email \"github-actions[bot]@users.noreply.github.com\"\n git add .github/badges/\n git diff --staged --quiet || git commit -m \"update badge\" && git push\n```\n\nAdd the dynamic badge to your README:\n```markdown\n[](https://your-site/.well-known/mcp.llmfeed.json)\n```\n\n**Features:**\n- β
Automatic PR checks for feed changes\n- β
Ed25519 signature verification\n- β
Dynamic shields.io badge (SVG + JSON)\n- β
Security score output (0-100)\n- β
Color-coded badges (green 80+, yellow 40+, red invalid)\n\nSee [packages/github-action/README.md](packages/github-action/README.md) for complete documentation.\n\n### @25xcodes/llmstxt-parser\n\nParse and validate [llms.txt](https://llmstxt.org) files with RAG utilities.\n\n```typescript\nimport { parseLLMSTxt, validateLLMSTxt, fetchLLMSTxt } from '@25xcodes/llmstxt-parser'\n\n// Parse markdown\nconst doc = parseLLMSTxt(markdown)\nconsole.log(doc.title, doc.links)\n\n// Validate\nconst result = validateLLMSTxt(doc)\nconsole.log(result.valid, result.score)\n\n// Fetch from URL or domain\nconst doc = await fetchLLMSTxt('example.com')\n```\n\n**Features:**\n- π Parse llms.txt markdown into structured documents\n- β
Validate per llmstxt.org specification with quality scoring\n- π Discover llms.txt from well-known paths\n- π― RAG utilities: token estimation, format conversion, link extraction\n- π Zero runtime dependencies, works in Node.js and browsers\n\nSee [packages/llmstxt-parser/README.md](packages/llmstxt-parser/README.md) for complete documentation.\n\n### @25xcodes/llmfeed-health-monitor (CLI)\n\nFeed health monitoring, crawling, and outreach automation.\n\n```bash\nnpm install -g @25xcodes/llmfeed-health-monitor\n\nllmfeed-health check https://example.com/.well-known/mcp.llmfeed.json\nllmfeed-health crawl https://site1.com https://site2.com\nllmfeed-health discover example.com\nllmfeed-health report https://example.com/feed.json --output report.html\n```\n\n**Features:**\n- π Feed crawler with opt-out detection\n- π HTML & JSON health reports\n- π Multi-channel notifications (GitHub Issues, Email, Twitter)\n- β° Scheduled monitoring with cron\n\nSee [packages/health-monitor/README.md](packages/health-monitor/README.md) for complete documentation.\n\n## Roadmap\n\n### β
Completed\n\n1. **CLI Validator Package** β `@25xcodes/llmfeed-validator`\n - Full Ed25519 signature verification\n - Structural and schema validation \n - Security scoring with detailed diagnostics\n - JSON output mode for CI/CD scripting\n\n2. **Feed Signing Tool** β `@25xcodes/llmfeed-signer`\n - Ed25519 keypair generation (PKCS#8 format)\n - Feed signing with configurable `signed_blocks`\n - PEM and base64 key formats\n - CI/CD-friendly CLI interface\n\n3. **GitHub Action** β `@25xcodes/llmfeed-action`\n - Automatic PR checks for feed changes\n - Ed25519 signature verification in CI\n - Dynamic SVG badge generation\n - Outputs for downstream workflow steps\n\n4. **Feed Health Monitor** β `@25xcodes/llmfeed-health-monitor`\n - Feed crawler with opt-out detection\n - HTML & JSON health reports\n - GitHub Issues / Email / Twitter notifications\n - Scheduled monitoring with cron\n\n5. **LLMS.txt Parser** β `@25xcodes/llmstxt-parser`\n - Parse llms.txt per llmstxt.org specification\n - Validation with quality scoring\n - Well-known path discovery\n - RAG utilities (tokens, format, links)\n\n### π Planned\n\n6. **Feed Schema Generator**\n - Generate LLMFeed from OpenAPI/Swagger specs\n - Import from existing MCP server definitions\n - TypeScript type generation from feed schemas\n - Reduce manual feed authoring friction\n\n7. **Multi-Feed Aggregator**\n - Combine multiple feeds into unified index\n - Namespace collision detection\n - Cross-feed capability search\n - Agent-optimized merged output\n\n## Reference Implementation\n\nThis project validates against the **25x.codes** reference feed:\n\n```\nhttps://25x.codes/.well-known/mcp.llmfeed.json\n```\n\n\nKey features demonstrated:\n- Full Ed25519 signature with trust block\n- JSON-RPC 2.0 invocation pattern\n- Typed capabilities with input/output schemas\n- Agent guidance with fallback instructions\n\n## Related Documentation\n\n- [Validator User Guide](VALIDATOR_GUIDE.md) β Detailed validation feature documentation\n- [Validator Status](VALIDATOR_STATUS.md) β Implementation completeness report\n- [Product Requirements](PRD.md) β Full PRD with design specifications\n\n## Protocol Standards\n\n| Standard | Status | Description |\n|----------|--------|-------------|\n| **MCP** | Compatible | Anthropic's Model Context Protocol (JSON-RPC 2.0) |\n| **WebMCP** | Compatible | W3C Web ML Community Group proposal |\n| **LLMFeed** | Primary Focus | Static file-based feed specification |\n\n## Contributing\n\nContributions are welcome! Areas where help is especially needed:\n\n- [ ] Additional embedding model support\n- [ ] Feed schema versioning system\n- [ ] Internationalization (i18n)\n- [ ] Accessibility improvements\n- [ ] E2E test coverage\n\n## License\n\nThis project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.\n\n---\n\n