feat: scaffold MCP server with robot tools (#299)

* feat: scaffold MCP server with robot tools

* feat: add MCP create assembly tool

* feat: add MCP assembly status tools

* feat: add MCP golden templates

* feat: add streamable http transport

* docs: tighten MCP server spec

* feat: add robot catalog helpers

* feat: add upload behavior controls

* feat: add input file prep helper

* docs: update MCP todo status

* chore: apply lint fixes

* test: add resume assembly e2e

* test: cover lint issue formatting

* test: cover base64 limit error

* test: cover url import injection

* feat: download URL inputs by default

* feat: allow multiple URLs per import step

* test: cover robot helpers

* chore: add mcp-server to knip config

* chore: update transloadit parity baseline

* feat(mcp-server): support bearer tokens

* docs(mcp): note signature auth with bearer

* docs: refresh README and MCP todo

* w

* refactor(mcp-server): share http handler logic

* fix: harden input handling

* feat: allow private URL downloads by default

* docs(node): document prepareInputFiles options

* fix: trust assembly url for cancel

* feat(mcp-server): add sev-logger with redaction

* chore: format transloadit baseline

Author: kvz

.ai/skills/council-refactor-ideas/SKILL.md

@@ -0,0 +1,18 @@
+---
+name: council-refactor-ideas
+description:
+  Run `~/code/dotfiles/bin/council.ts refactor` to get a multi-agent refactoring ideas, evaluate
+  proposals, and bring them to the human.
+---
+
+# Council Refactoring Ideas
+
+## Overview
+
+Run the local `council.ts refactor` script to get multi-agent refactoring brainstorms, then triage
+and address valid issues before final validation and PR creation.
+
+## Workflow
+
+Run `~/code/dotfiles/bin/council.ts refactor` to get some more refactoring ideas and see which ones
+make sense.

.ai/skills/council-review/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: council-review
+description:
+  Run `~/code/dotfiles/bin/council.ts review` to perform a multi-model review, evaluate findings,
+  fix valid issues (with tests when possible), add clarifying comments for invalid findings, then
+  run required checks. Use before PR creation or when the user asks for a deep review.
+---
+
+# Council Review
+
+## Overview
+
+Run the local `council.ts review` script to get multi-model review findings, then triage and address
+valid issues before final validation and PR creation.
+
+## Workflow
+
+### 1) Preflight
+
+- Confirm the script exists and is executable: `~/code/dotfiles/bin/council.ts`.
+- Do not use `--post` unless explicitly asked.
+- Expect a long runtime (30+ minutes); so set any command timeout on your side to >= 45 minutes.
+
+### 2) Run the review
+
+- Run: `~/code/dotfiles/bin/council.ts review` from inside the repository we were working on.
+- Capture the consolidated output (P0-P3 items or "No issues found.").
+
+### 3) Triage findings
+
+For each item:
+
+- **Valid + worth fixing**
+  - If tests exist for the area, add or extend coverage for the issue.
+  - Run the test and confirm it fails.
+  - Apply the fix and re-run the test to confirm it passes.
+- **Invalid or not worth fixing**
+  - Add a brief code comment explaining why it is safe or intentional.
+
+### 4) Re-run review if needed
+
+- Re-run `council.ts review` only if you made substantive changes that affect earlier findings.
+
+### 5) Final validation
+
+- Run repo-required checks (for this repo: `yarn check`).
+- Note any warnings but avoid unrelated changes unless required.
+
+## Notes
+
+- Avoid modifications while running; only edit after it finishes.
+- If `council.ts review` fails, consider the errors, source code, and propose a fix for the review
+  script, but do not change it, just propose it to the human

.changeset/mcp-logger-redaction.md

@@ -0,0 +1,6 @@
+---
+"@transloadit/mcp-server": patch
+"@transloadit/node": patch
+---
+
+Add sev-logger based logging with redaction for MCP server, and improve input handling with trusted assembly URLs and configurable URL download restrictions.

README.md

@@ -11,18 +11,51 @@
 
 # Transloadit JavaScript/TypeScript SDKs
 
-Monorepo for Transloadit SDKs and shared packages.
+Monorepo for Transloadit SDKs, shared packages, and the MCP server.
 
-For SDK usage docs, see `packages/node/README.md`.
+For full SDK usage docs, see `packages/node/README.md`.
 
 ## Packages
 
-- `@transloadit/node` — Node.js SDK + CLI (experimental). See `packages/node/README.md`.
+- `@transloadit/node` — Node.js SDK + CLI. See `packages/node/README.md`.
 - `transloadit` — Stable unscoped package (built from `@transloadit/node`).
+- `@transloadit/mcp-server` — MCP server (Streamable HTTP + stdio).
 - `@transloadit/types` — Shared TypeScript types.
 - `@transloadit/utils` — Shared utilities.
 - `@transloadit/zod` — Zod schemas for Transloadit APIs.
 
+## Quick start
+
+### Node SDK
+
+```ts
+import { Transloadit } from '@transloadit/node'
+
+const client = new Transloadit({
+  authKey: process.env.TRANSLOADIT_KEY as string,
+  authSecret: process.env.TRANSLOADIT_SECRET as string,
+})
+
+const result = await client.createAssembly({
+  params: {
+    steps: {
+      ':original': { robot: '/upload/handle' },
+    },
+  },
+  files: { file: '/path/to/file.jpg' },
+  waitForCompletion: true,
+})
+```
+
+### MCP server (local)
+
+```bash
+corepack yarn workspace @transloadit/mcp-server build
+node packages/mcp-server/dist/cli.js http --host 127.0.0.1 --port 5723
+```
+
+See `docs/mcp-spec.md` for the MCP design and `docs/mcp-todo.md` for the remaining work.
+
 ## Development
 
 - Install: `corepack yarn`
@@ -35,4 +68,3 @@ See `CONTRIBUTING.md` for full guidelines.
 
 - Docs live under `docs/`.
 - The `transloadit` package is prepared via `scripts/prepare-transloadit.ts`.
-