# CaskMCP v0.1.0-alpha.1

## Highlights
- Introduces the Magic Loop via `caskmcp mint`: capture traffic, compile artifacts, create a toolpack, and print MCP config.
- Adds first-class toolpacks under `.caskmcp/toolpacks/<toolpack_id>/` with deterministic metadata.
- Enables direct MCP serving from toolpacks with `caskmcp mcp serve --toolpack ...`.
- Improves runtime governance with toolsets, approvals, lockfiles, and drift-ready baselines.

## What Shipped
- `caskmcp mint <start_url> -a <allowed_host>` orchestration command.
- Headless-by-default Playwright capture for mint + optional scripted capture hook.
- Toolpack schema, resolver, and pending lockfile initialization.
- MCP serve support for resolving tools/policy/toolsets/lockfile from a toolpack.
- Proxy mode lockfile requirement by default, with explicit unsafe escape hatch.
- Full package rename to `caskmcp` and runtime defaults under `.caskmcp/`.

## Quickstart
```bash
caskmcp mint https://app.example.com -a api.example.com --print-mcp-config
caskmcp mcp serve --toolpack .caskmcp/toolpacks/<toolpack-id>/toolpack.yaml
```

## Security Defaults
- Deny-by-default policy behavior.
- Host allowlist enforcement.
- Private network access blocked unless explicitly allowed.
- Redirects blocked unless explicitly allowed.
- Confirmation gating for state-changing operations.

## Known Limitations
- `caskmcp serve` dashboard command is a stub and not implemented yet.
- Playwright recording requires installed browser binaries (`playwright install chromium`).

## Validation
- Test suite: `266 passed`.
