v1.4.0 — MCP server, shared engine, cross-harness skill

Highlights

• MCP server (mcp/server.mjs) — a dependency-free JSON-RPC 2.0 stdio server exposing the same
  operations to any MCP-capable host (Claude Code, Codex, Cursor, DSH via mcp-client).
  Tools: spec_build, spec_check, audit, numbers, ledger, list_rules.
• Host-agnostic engine (lib/core.js) — one implementation per operation; the DSH plugin and the
  MCP server are thin adapters over it, so the two surfaces cannot drift apart.
• Six deliverable profiles: academic (29 rules) · software (15) · dataset (14) ·
  docs (13) · tender (12) · generic (9) — 38 checks in total.
• Agent skill (skill/SKILL.md, also registered at runtime) so other harnesses run the same procedure.

Design rules

• Every rule names a checker, a severity, a scope and a citation from the requirements text.
• Requirements no machine can verify become manual checklist items — never a fake automated check.
• A rule that cannot run reports skipped, never a silent pass.

Verification

stage	result
syntax (20 modules)	0 failed
marketplace readiness	35 passed
dependency-free runtime contract	33 passed
MCP protocol (stdio, real wire shapes)	20 passed
offline spec regression	all passed
cross-domain generality (software / dataset / docs, clean + defective)	all passed
harness contract / tool e2e / spec e2e	38 passed / 4 calls / negative control caught
real profile boot	pass

Install

# DSH plugin (after the npm publish)
dsh plugin --profile web add dsh-research-check

# Any MCP host
# {"transport":"stdio","serverName":"research-check",
#  "command":"node","args":["<plugin>/mcp/server.mjs"]}

Requires Node 22.19+ and Python 3.10+ (pip install pymupdf openpyxl pillow python-docx for PDF/Office rules).

Origin: extracted from a real 87-page competition manuscript pipeline, where every check
corresponds to a defect that actually shipped at least once.