Describe the CLI that exists; add publicInterfacesUsed guidance; drop cursor-mcp-dkg

[Jurij89]

Summary

• The README documented a CLI surface that largely did not exist. dkg integration search errored with unknown command; upgrade, uninstall and install --for cursor were never implemented; the community tier is shown with --tier community, not --include-community; and "handles the supported install kinds automatically (mcp, service, cli, agent-plugin, manual)" was true of two of the five. Rewritten against the CLI as it actually ships after fix(integrations): conform the CLI to the published registry schema dkg#1988.
• Adds guidance for choosing publicInterfacesUsed — the field the committee audits for scope compliance, and the most frequently mis-declared, because the rule only lived in a JSON Schema description contributors never read.
• Removes the cursor-mcp-dkg entry. It is the DKG's own MCP server, shipped with the node and installed by dkg mcp setup, so listing it in a registry of third-party integrations is redundant. Its entry had also drifted: pinned @origintrail-official/dkg-mcp@0.1.0-dev.1777029135 against a current 10.0.10, and pointed at the pre-rename dkg-v9 URL.

Related

• CLI-side companion: fix(integrations): conform the CLI to the published registry schema dkg#1988 — conforms the CLI's registry parser to this repo's published schema. This PR is independent of it and needs no CLI release.
• Root-cause analysis and plan: agent-docs/plans/2026-07-28-dkg-integrations-cli-contract.md (in the dkg repo)

Diagrams

• No flow changes — documentation, guidance, and one entry removal. The behavioural change lives in fix(integrations): conform the CLI to the published registry schema dkg#1988.

Files changed

File	What
README.md	User section rewritten to the three verbs that exist (list / search browse the registry, installed reports local state); states which install kinds are automated and which are not; --tier community corrected; upgrade/uninstall called out as not existing rather than quietly documented
CONTRIBUTING.md	New §3 guidance on choosing publicInterfacesUsed, with the decision rule stated plainly and the MCP-server case spelled out
integrations/cursor-mcp-dkg.json	Removed — redundant with dkg mcp setup, stale pin, pre-rename repo URL
package.json	security-checks script referenced the removed entry as a seed; updated so npm run security-checks keeps working

Test plan

• node scripts/validate.mjs → 2 entries checked · 0 errors · 1 warning (the pre-existing, disclosed VM-scope warning on buzz-dkg)
• npm run security-checks → 1 entry checked · 0 errors · 0 warnings
• grep -rn cursor-mcp-dkg . → no dangling references
• Every command in the rewritten README executed against the CLI from fix(integrations): conform the CLI to the published registry schema dkg#1988: list, search <kw>, list --tier community, info <slug>, install <slug>, install --dry-run, installed — all exist and exit 0
• dkg integration list --json → { entries, failures }, the shape it already shipped with, so this documents no breaking change

Notes for reviewers

The publicInterfacesUsed guidance is not hypothetical. #16 currently declares ["http-api", "mcp"] while its own security.notes describe a pure HTTP client ("Only communicates with the local DKG node… Bearer token read from DKG_AUTH_TOKEN or ~/.dkg/auth.token"). Per the schema's own rule it should list http-api alone — install.kind: mcp already records that it is an MCP server. Left as review feedback there rather than changed here.

🤖 Generated with Claude Code