Prepare plugin for Claude Directory submission

[ducnmm]

Review: @harrymove-ctrl
Slack thread: https://commandossworkspace.slack.com/archives/C0AP4MRC7J8/p1786365566628309

Why

Kenton is submitting Walrus Memory to the Claude Directory. This repo still looked like an internal handoff (last push 20 Aug): unpinned npx, plugin version 0.0.8, README/docs that say production OAuth is not live, and a SessionStart hook that drifted from MemWal.

Directory review also needs a privacy-policy link, support contact, and working examples. Missing those is an immediate reject.

What changed

• Pin @mysten-incubation/memwal-mcp@0.0.13 in .mcp.json, Codex installer, and client docs (WALM-627: unpinned npx can reuse a cached 0.0.5). 0.0.13 is npm latest. In-tree MemWal currently writes 0.0.14, which is not published — pinning that would break installs.
• Bump plugin version to 0.0.13 so Directory users actually receive this packaging.
• Rewrite README: install, three example prompts, privacy/terms/support. Drop "handoff / pending transfer" copy.
• Document the live production connector (https://relayer.memory.walrus.xyz/api/mcp) in SETUP.md and hosted-connector.md. Dev/staging stay labeled as non-production.
• Sync on_session_start.mjs with current MemWal (save in the same turn, include config values, don't ask).
• CI now fails if .mcp.json is unpinned; check_mcp_release.mjs requires the pin to exist on npm and be >= 0.0.13.

claude plugin validate . --strict passes locally (Claude Code 2.1.219). Hook tests pass.

Out of scope (still needed for submit)

• Transfer this repo to MystenLabs (Harry's blocker). repository in plugin.json still points at CommandOSSLabs until that happens.
• Reviewer test account / demo for Anthropic (Kimberly, 14 Aug).
• Connector-side confirmation that every remote tool (including logout) has title + readOnlyHint / destructiveHint.

Test plan

• claude plugin validate . --strict
• node --test test/*.test.mjs
• node scripts/check_mcp_release.mjs (pin 0.0.13, npm latest 0.0.13)
• CI on this PR
• After merge: claude --plugin-dir . → /mcp shows memwal, /memwal:setup still works

[ducnmm]

@harrymove-ctrl please review this for the Claude Directory submit.

Context is the Walrus Memory connector/plugin thread: https://commandossworkspace.slack.com/archives/C0AP4MRC7J8/p1786365566628309 (Kenton asked us to supply the listing info).

CI is green. Main packaging fixes: pin @mysten-incubation/memwal-mcp@0.0.13, directory-ready README (privacy/support/examples), live prod connector URL, SessionStart hook synced with MemWal.

Repo transfer to MystenLabs is still a separate step before Kenton submits.

[harrymove-ctrl]

Review

Verified every claim in the description against npm, the live production relayer, MemWal dev, and the docs site. One submission-blocking defect found and fixed in 961dbdd (CI green on it). Everything else checks out.

---

🔴 Fixed: 404 documentation link

https://docs.wal.app/walrus-memory/mcp/claude-code returns 404. It appeared twice in the README — the Publisher: line and the Product docs: bullet — and it is the natural Documentation URL for the submission form. This is exactly the class of thing the description calls "an immediate reject."

Root cause: docs.wal.app does not resolve extensionless paths under /walrus-memory/**. The .html form serves the page:

URL	Status
/walrus-memory/mcp/claude-code	404
/walrus-memory/mcp/claude-code.html	200
/walrus-memory/, /walrus-memory/getting-started/quick-start, /docs/getting-started	404
/docs/legal/privacy, /docs/legal/walrus_general_tos	200

Legal pages are the exception, which is why those two links passed unnoticed.

961dbdd switches both README links to .html.

Separate docs bug, not fixable here: sitemap.xml advertises the extensionless forms, so the sitemap is publishing 404s and any link copied from it will be dead. Worth its own ticket against the docs site.

---

✅ Verified

• Pin @mysten-incubation/memwal-mcp@0.0.13 — npm latest is exactly 0.0.13, published 2026-09-15. 0.0.14 is genuinely unpublished; only 0.0.14-dev.0 exists, under the dev dist-tag. The reasoning in the description is correct.
• Hook sync — scripts/on_session_start.mjs is byte-identical to MemWal dev (sha256 9bd745f09103f1e54cf6b2728a954dfbb2bd2a7066be0fe65d3097340ddcd208). Not approximately synced — identical.
• Production connector is live — both discovery endpoints return 200; Dynamic Client Registration at /oauth/register; PKCE S256; scopes memwal:read, memwal:write, offline_access; resource_name "Walrus Memory". Unauthenticated tools/list correctly returns unauthorized.
• CI gate works — check_mcp_release.mjs runs in CI and now verifies the pin is published and >= 0.0.13, warning rather than failing when it lags latest. Good call on warn-not-fail; a hard fail there would break CI every time MemWal releases.
• All 7 commands referenced in the README exist. Repo is public, Apache-2.0, issues enabled, so the README's support route is real.

---

🟢 Open item #3 is already done

Connector-side confirmation that every remote tool (including logout) has title + readOnlyHint / destructiveHint.

Landed on MemWal dev in services/server/scripts/mcp/tools/annotations.ts:

Tool	Title	readOnlyHint	destructiveHint
memwal_remember	Remember a Fact	false	false
memwal_remember_bulk	Remember Multiple Facts	false	false
memwal_analyze	Analyze and Remember	false	true
memwal_restore	Restore Memory Index	false	false
memwal_recall	Recall Memories	true	false
memwal_health	Check Walrus Memory Health	true	false

The logout concern is moot: memwal_login and memwal_logout are local-stdio only and are deliberately absent from the remote surface. Only these 6 memory tools are exposed.

What is still unverified: whether production is deployed from a commit that includes annotations.ts. The endpoint requires OAuth so it cannot be checked from outside. If the Directory form's captured tool list comes back with empty titles, production is behind dev — deploy first, then reconnect and recapture.

---

🟡 Non-blocking, worth a follow-up

0.0.13 is now hardcoded in 8 places across 6 files (.mcp.json, plugin.json, README.md, docs/usage/codex.md, docs/usage/other-clients.md, skills/setup/SETUP.md, skills/setup/SKILL.md, scripts/install_codex_hooks.mjs), but CI only enforces .mcp.json. The next bump will silently drift the docs out of sync with the actual pin. Suggest a CI step asserting that every documented pin matches .mcp.json.

Also worth deciding: plugin.json couples the plugin version to the MCP package version, so packaging-only fixes can't ship without implying a new MCP release. Fine for the initial listing, but it will bite eventually.

---

Merge state

mergeable: true, mergeable_state: blocked — the only thing blocking is the required approving review. Branch protection requires 1 approval plus validate (strict), with enforce_admins on. validate is green on 961dbdd.

Publisher identity — needs a decision before submitting

Inconsistent across surfaces:

• Connectors Directory form: Walrus Foundation (contact kenton@walrus.xyz)
• .claude-plugin/plugin.json author: Mysten Labs / https://mystenlabs.com
• npm scope: @mysten-incubation
• Docs and dashboard: walrus.xyz

Recommend keeping Walrus Foundation on the connector listing — it matches both the contact email domain and the product domain — and deciding separately whether the plugin manifest should follow.

[ducnmm]

@harrymove-ctrl thanks — leftover 404 is in 961dbdd; please Approve so this can merge.