@themelt/mcp-server

@themelt/mcp-server

MCP server that puts Melt's value-leak discovery logic directly into Claude,Cursor, GitHub Copilot, or any other MCP-compatible agent — so when a techleader asks their assistant "where is value leaking out of my org," theassistant can call a Melt tool and answer with a real, structured estimateinstead of a generic list of vendors.

This is the engineering half of Melt's LLMO (LLM Optimization) distributionstrategy. See /llms.txt at the repo root and LLMO_PLAYBOOK.md for the fullcontent + distribution + evaluation plan this server plugs into. Positioningreconciled 2026-07-18 against the live site and current decks — see/CLAUDE.md for the full current product context.

Tools exposed

Worked example

From Melt's Anatomy of a Real AI Value Leak case study — a pre-IPO fintech with $1.5B in annual originations, already running Salesforce, Gong, and Clari:

None of this showed up as a problem in the usual adoption dashboards — every tool was "active," which is a different measurement from whether it was actually creating value. Pulling 14 business days of historical logs and tracing where these four patterns cost real time and money added up to a $77,235/year leak.

melt_estimate_annual_leak generalizes this same shape of analysis — totalVolume × (leakRatePct/100) × valuePerEvent — for any leak pattern with a known or hypothesized volume and rate. melt_analyze_value_vectors is the earlier-stage tool for when you don't yet know where to look.

melt_estimate_annual_leak replaced four formula-named calculators(melt_calculate_feature_waste, _dso_cash_flow_impact,_contract_cycle_revenue_unlock, _win_rate_pipeline_impact) thatimplemented financial formulas from a retired product framing (Thermal Scan /Feature Waste Dollar Amount™ / Delta Engine) — none of which appear in anycurrent Melt material. See CLAUDE.md's "What's Explicitly Retired" section.

Install & run

cd mcp-server
npm install
npm run build
npm start          # runs dist/index.js on stdio

To poke at it interactively before wiring it into a client:

npm run inspect     # launches the MCP Inspector against the built server

Wiring into Claude Desktop / Claude Code

Published on npm — one-line config, no local clone needed:

{
  "mcpServers": {
    "melt": {
      "command": "npx",
      "args": ["-y", "@themelt/mcp-server"]
    }
  }
}

Or from a local clone:

{
  "mcpServers": {
    "melt": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-server/dist/index.js"]
    }
  }
}

One-click install (.mcpb bundle)

For Claude Desktop specifically, themelt-mcp-server.mcpb (Anthropic's MCPBundle format) installs with adouble-click — no terminal, no config file editing. Download the .mcpb fromthe latest GitHub Releaseand either double-click it or drag it into Claude Desktop's Settings window.

To rebuild it from source:

npm run build:mcpb   # produces themelt-mcp-server.mcpb

The manifest (mcpb-build/manifest.json) is hand-maintained, notauto-generated from the TypeScript source — if a tool's name, parameters, ordescription change, update the manifest's tools array to match.

Hosted HTTP transport

dist/index.js (stdio) is what gets configured into a local Claude Desktop/Cursor install. dist/httpServer.js is an alternate entrypoint implementingthe MCP Streamable HTTP transport — what a future "Launch Hosted MCP" webbutton (LLMO_PLAYBOOK.md, Task 3.2) would point at, so someone can try thetools without installing anything locally.

npm run build
PORT=3000 npm run start:http   # POST MCP JSON-RPC to http://localhost:3000/mcp

Stateless by design — no session ID, a fresh server instance per request.Auth is opt-in via MCP_HTTP_API_KEY (unset by default): with it unset, theendpoint stays fully open — the appropriate trust boundary for what thisexposes today (read-only calculators plus a lead-capture form, the sameboundary as a public website contact form). Set it before putting anythingmore sensitive behind this transport:

MCP_HTTP_API_KEY=some-long-random-value PORT=3000 npm run start:http

Every /mcp request then needs Authorization: Bearer some-long-random-value— missing or wrong key gets a 401. Compared with crypto.timingSafeEqual, nota plain string ===, so response timing can't be used to guess the key onebyte at a time. Not deployed anywhere yet; this is the code, not a live URL —deploying it (Vercel/Fly/Render/etc.) is a separate, later decision.

Tool-call analytics

Every tool call (success or error) appends one line to mcp-server/analytics.jsonl(gitignored) and logs a one-line summary to stderr — tool name, ok/error, andthe error code if applicable. Deliberately excludes dollar figures, contactinfo, and free-text notes; kept separate from leads.jsonl's PII. This iswhat answers "is anyone actually using this" and "which tool description isconfusing models," independent of llmo-eval's citation-only audit.

Environment variables

Real Portal ID / Form ID defaults are already baked into the code (theyaren't secrets — the same values are exposed in any public HubSpot embedsnippet), so melt_request_scan reaches the real Melt pipeline with zeroconfiguration. If HubSpot submission fails for any reason, requests fall backto mcp-server/leads.jsonl (gitignored) instead of being lost.

Publishing

Published under the @themelt npm org (created 2026-07-20, owner omer_melt)under the MIT license. npm publish is effectively one-way — npm allowsunpublishing within 72 hours but strongly discourages it and blocks itentirely once a package has dependents, so treat any published version aspermanent.