Make repo public + tag v1.0.0 to unblock plugin distribution

Make repo public + tag v1.0.0 to unblock plugin distribution

Why

Azure/documentdb-agent-kit ships plugin configs for Claude / Codex / Cursor / Gemini / Copilot / VS Code that point at an npm package (documentdb-mcp-server) that was unpublished on 2025-04-17. Every plugin install is broken today.

The fastest unblock is to publish this MCP server's source as a public repo and have the plugins fetch via npx github:microsoft/documentdb-mcp#v1.0.0. A polished npm package (v2) ships later — see #TBD.

Pre-flight hygiene (do before flipping visibility)

The repo currently passes secret-scanning with push protection enabled, but a public flip will trigger Snyk and other external scanners. Run through these once:

• Git history sweep for credentials in past commits:

  git log -p --all | rg -i 'password|token|connection|secret|api[_-]?key' | head -200
  

  If anything legitimate-looking turns up, rewrite history (git filter-repo) before going public.
• gh secret-scanning alerts list -R microsoft/documentdb-mcp — confirm zero open alerts.
• README install snippets all reference github:microsoft/documentdb-mcp consistently (the VS Code / Cursor install badges already do; double-check the manual-install and Docker sections).
• package.json audit:
  • name, version, description, license, repository, homepage are correct
  • bin field points at the right entry script (so npx knows what to run)
  • files field whitelists everything npx needs (compiled output + manifests)
  • prepare or prepack script builds TS so npx can compile on first install
• Compiled-output strategy decision: ship dist/ in the GitHub repo, OR rely on a prepare script. npx github:... does run prepare, but it adds 30–60s to cold start. Recommend: commit dist/ to the v1.0.0 tag specifically, even if it's .gitignored on main, so the public spec installs fast.
• LICENSE present (MIT or whatever Microsoft OSPO requires).
• SECURITY.md present per Microsoft OSPO requirements for public repos.
• CODE_OF_CONDUCT.md + SUPPORT.md per Microsoft OSPO.
• OSPO clearance: confirm the repo has been through Microsoft Open Source Programs Office release review.

Flip + tag

• Set visibility → Public (Settings → Danger Zone)
• Verify external npx -y github:microsoft/documentdb-mcp works from a fresh machine with no GitHub auth
• Create release tag v1.0.0 on the commit that has the validated dist/
• Update README to reference the tag explicitly in install snippets

Post-flip validation

• Trigger a Snyk re-scan and confirm no new High/Critical findings
• Confirm secret-scanning, Dependabot, and CodeQL are all enabled on the now-public repo
• Hand off to Azure/documentdb-agent-kit#TBD to swap the plugin configs

Done when

• Repo is public
• v1.0.0 tag exists with a working dist/
• Fresh npx -y github:microsoft/documentdb-mcp#v1.0.0 succeeds on a machine outside the Microsoft network
• Agent-kit unblock issue is unblocked

Start with package.json and the README install snippets, then run the listed history and secret-scanning checks. Validate the package from a fresh machine with npx and inspect the release checklist before creating v1.0.0. Done means the repository is public, the tag includes working dist output, and the external install succeeds.