chore: prepare for npm publish — fix peer deps, add sideEffects, update README, add metadata

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: mstuart

.github/SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it responsibly:
+
+1. **Do not** open a public issue
+2. Email the maintainer or use [GitHub's private vulnerability reporting](https://github.com/mstuart/graphql-agent-toolkit/security/advisories/new)
+3. Include steps to reproduce and potential impact
+
+We will acknowledge receipt within 48 hours and aim to release a fix within 7 days for critical issues.
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| 0.1.x   | Yes       |

.nvmrc

@@ -0,0 +1 @@
+20

README.md

@@ -4,7 +4,7 @@
 [![npm version](https://img.shields.io/npm/v/graphql-agent-toolkit.svg)](https://www.npmjs.com/package/graphql-agent-toolkit)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
-Turn any GraphQL API into AI-agent-ready tools -- MCP servers, LangChain tools, and standalone SDKs.
+Turn any GraphQL API into AI-agent-ready tools -- MCP servers, LangChain tools, and framework adapters.
 
 **graphql-agent-toolkit** introspects a GraphQL endpoint, generates typed operations, and exposes them as tools that AI agents can discover and call. It supports the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) out of the box, so you can connect any MCP-compatible AI client to any GraphQL API in seconds.
 
@@ -23,9 +23,17 @@ npx graphql-agent-toolkit serve --endpoint https://your-api.com/graphql
 ## Installation
 
 ```bash
-npm install graphql-agent-toolkit
+npm install graphql-agent-toolkit graphql
 ```
 
+## Requirements
+
+- Node.js >= 18.0.0
+- `graphql` >= 16.0.0 (peer dependency)
+- TypeScript >= 5.0 (optional, for type definitions)
+
+Fully written in TypeScript with complete type exports for all public APIs.
+
 ## Features
 
 - **Schema Introspection** -- Automatically fetches and parses any GraphQL schema

package-lock.json

@@ -41,7 +41,12 @@
     "agent",
     "toolkit",
     "langchain",
-    "model-context-protocol"
+    "model-context-protocol",
+    "crewai",
+    "vercel-ai",
+    "introspection",
+    "typescript",
+    "sdk"
   ],
   "author": "Mark Stuart",
   "license": "MIT",
@@ -53,17 +58,21 @@
   "bugs": {
     "url": "https://github.com/mstuart/graphql-agent-toolkit/issues"
   },
+  "sideEffects": false,
   "engines": {
     "node": ">=18.0.0"
   },
+  "peerDependencies": {
+    "graphql": "^16.12.0"
+  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",
     "commander": "^14.0.3",
-    "graphql": "^16.12.0",
     "graphql-request": "^7.4.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {
+    "graphql": "^16.12.0",
     "@types/node": "^25.2.3",
     "@typescript-eslint/eslint-plugin": "^8.55.0",
     "@typescript-eslint/parser": "^8.55.0",