LumabyteCo/clarifyprompt-mcp

ClarifyPrompt now speaks A2A (Agent-to-Agent) — the final step of the MCP modernization roadmap (7/7). Other agents can now call ClarifyPrompt to compile prompts. stdio stays the default; nothing about existing setups changes.

Set CLARIFYPROMPT_TRANSPORT=a2a and ClarifyPrompt comes up as a discoverable A2A peer on Node's built-in http (only new dep: the official @a2a-js/sdk, which pulls just uuid):

| Endpoint | Purpose |
|---|---|
| GET /.well-known/agent-card.json | Agent card — discovery + the compile-prompt-for-platform skill |
| POST /a2a | A2A JSON-RPC 2.0: message/send, message/stream (SSE), tasks/get, tasks/cancel, … |
| GET /health | Liveness |

CLARIFYPROMPT_TRANSPORT=a2a CLARIFYPROMPT_HTTP_PORT=3000 npx clarifyprompt-mcp

The earlier roadmap primitives map straight onto A2A semantics:

• Compile — message/send returns a task whose artifact carries the optimized prompt (text) + the full structured compose result (data).
• Streaming (1.10.0 progress → A2A) — message/stream emits status-update events per pipeline stage, then the artifact, over SSE.
• Cancellation (1.10.0 AbortSignal → A2A) — tasks/cancel aborts the in-flight compose in ~ms; a client that disconnects mid-stream does too.
• Clarification (1.9.0 elicitation → A2A) — off by default for one-shot peers; opt in with pre_clarify: 'auto'|'always' and an ambiguous prompt pauses the task in A2A's first-class input-required state. Answer on the same task and it compiles.

Hardened (pre-ship adversarial review: 22 findings → 13 fixed, each re-verified live)

• A malformed HTTP request line no longer crashes the process (unguarded new URL) — fixed on both the a2a and streamable-http transports.
• Client disconnect aborts the in-flight compose (no orphaned LLM work/cost).
• Empty-prompt message/send → clean failed task (was an opaque -32603).
• 4 MB request-body cap; bounded LRU task store; malformed JSON → spec-correct -32700; clarify suggested defaults now render; terminal SSE error frame; startup env validation.

Tests

New npm run test:a2a (8 sections incl. hardening + disconnect-cancel) and test:http H6 — all green on gemma4:31b-cloud. @a2a-js/sdk adds 0 vulnerabilities.

Full notes: CHANGELOG.md

🤖 Generated with Claude Code