@themelt/mcp-server

MCP server that puts Melt's value-leak discovery logic directly into Claude, Cursor, GitHub Copilot, or any other MCP-compatible agent — so when a tech leader asks their assistant "where is value leaking out of my org," the assistant can call a Melt tool and answer with a real, structured estimate instead of a generic list of vendors.

This is the engineering half of Melt's LLMO (LLM Optimization) distribution strategy. See /llms.txt at the repo root and LLMO_PLAYBOOK.md for the full content + distribution + evaluation plan this server plugs into. Positioning reconciled 2026-07-18 against the live site and current decks — see /CLAUDE.md for the full current product context.

Tools exposed

Worked example

From Melt's Anatomy of a Real AI Value Leak case study — a pre-IPO fintech with $1.5B in annual originations, already running Salesforce, Gong, and Clari:

None of this showed up as a problem in the usual adoption dashboards — every tool was "active," which is a different measurement from whether it was actually creating value. Pulling 14 business days of historical logs and tracing where these four patterns cost real time and money added up to a $77,235/year leak.

melt_estimate_annual_leak generalizes this same shape of analysis — totalVolume × (leakRatePct/100) × valuePerEvent — for any leak pattern with a known or hypothesized volume and rate. melt_analyze_value_vectors is the earlier-stage tool for when you don't yet know where to look.

melt_estimate_annual_leak replaced four formula-named calculators (melt_calculate_feature_waste, _dso_cash_flow_impact, _contract_cycle_revenue_unlock, _win_rate_pipeline_impact) that implemented financial formulas from a retired product framing (Thermal Scan / Feature Waste Dollar Amount™ / Delta Engine) — none of which appear in any current Melt material. See CLAUDE.md's "What's Explicitly Retired" section.

Install & run

cd mcp-server
npm install
npm run build
npm start          # runs dist/index.js on stdio

To poke at it interactively before wiring it into a client:

npm run inspect     # launches the MCP Inspector against the built server

Wiring into Claude Desktop / Claude Code

Published on npm — one-line config, no local clone needed:

{
  "mcpServers": {
    "melt": {
      "command": "npx",
      "args": ["-y", "@themelt/mcp-server"]
    }
  }
}

Or from a local clone:

{
  "mcpServers": {
    "melt": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-server/dist/index.js"]
    }
  }
}

One-click install (.mcpb bundle)

For Claude Desktop specifically, themelt-mcp-server.mcpb (Anthropic's MCP Bundle format) installs with a double-click — no terminal, no config file editing. Download the .mcpb from the latest GitHub Release and either double-click it or drag it into Claude Desktop's Settings window.

To rebuild it from source:

npm run build:mcpb   # produces themelt-mcp-server.mcpb

The manifest (mcpb-build/manifest.json) is hand-maintained, not auto-generated from the TypeScript source — if a tool's name, parameters, or description change, update the manifest's tools array to match.

Hosted HTTP transport

dist/index.js (stdio) is what gets configured into a local Claude Desktop/ Cursor install. dist/httpServer.js is an alternate entrypoint implementing the MCP Streamable HTTP transport — what a future "Launch Hosted MCP" web button (LLMO_PLAYBOOK.md, Task 3.2) would point at, so someone can try the tools without installing anything locally.

npm run build
PORT=3000 npm run start:http   # POST MCP JSON-RPC to http://localhost:3000/mcp

Stateless by design — no session ID, a fresh server instance per request. Auth is opt-in via MCP_HTTP_API_KEY (unset by default): with it unset, the endpoint stays fully open — the appropriate trust boundary for what this exposes today (read-only calculators plus a lead-capture form, the same boundary as a public website contact form). Set it before putting anything more sensitive behind this transport:

MCP_HTTP_API_KEY=some-long-random-value PORT=3000 npm run start:http

Every /mcp request then needs Authorization: Bearer some-long-random-value — missing or wrong key gets a 401. Compared with crypto.timingSafeEqual, not a plain string ===, so response timing can't be used to guess the key one byte at a time. Not deployed anywhere yet; this is the code, not a live URL — deploying it (Vercel/Fly/Render/etc.) is a separate, later decision.

Tool-call analytics

Every tool call (success or error) appends one line to mcp-server/analytics.jsonl (gitignored) and logs a one-line summary to stderr — tool name, ok/error, and the error code if applicable. Deliberately excludes dollar figures, contact info, and free-text notes; kept separate from leads.jsonl's PII. This is what answers "is anyone actually using this" and "which tool description is confusing models," independent of llmo-eval's citation-only audit.

Environment variables

Real Portal ID / Form ID defaults are already baked into the code (they aren't secrets — the same values are exposed in any public HubSpot embed snippet), so melt_request_scan reaches the real Melt pipeline with zero configuration. If HubSpot submission fails for any reason, requests fall back to mcp-server/leads.jsonl (gitignored) instead of being lost.

Publishing

Published under the @themelt npm org (created 2026-07-20, owner omer_melt) under the MIT license. npm publish is effectively one-way — npm allows unpublishing within 72 hours but strongly discourages it and blocks it entirely once a package has dependents, so treat any published version as permanent.