@launchsecure/launch-sdk

Typed server-side client for LaunchSecure's MCP (Model Context Protocol) server. Thin wrapper around @modelcontextprotocol/sdk that handles PAT authentication, project resolution, and typed helpers for the most common operations.

Status: v0.1. Only feedback.create() is implemented. Additional methods (workItems, comments, board, tags, etc.) will be added as consumer needs emerge.

Install

npm install @launchsecure/launch-sdk
# or
pnpm add @launchsecure/launch-sdk

Quick start

import { LaunchSecureClient } from '@launchsecure/launch-sdk';

const client = new LaunchSecureClient({
  baseUrl: 'https://launchsecure.app',
  pat:     process.env.LAUNCHSECURE_PAT!,
});

await client.feedback.create({
  orgSlug:     'automate-with-us',
  projectSlug: 'internal-feedback-prod',
  description: 'The button on the dashboard is misaligned',
  severity:    'bug',
  screenshotUrl: 'https://my-storage.example.com/abc.jpg',
  metadata: {
    url: 'https://launchsecure.app/foo',
    userAgent: navigator.userAgent,
    viewport: { w: 1920, h: 1080, dpr: 2 },
    screen:   { w: 2560, h: 1440 },
    timezone: 'America/New_York',
    locale:   'en-US',
    capturedAt: new Date().toISOString(),
  },
  pins:    [],
  context: { submitterEmail: '[email protected]' },
});

Why this exists

LaunchSecure exposes its data model through MCP tools (communication_write, work_item_create, etc.). The official @modelcontextprotocol/sdk is generic — it knows nothing about LaunchSecure's tool names, payload shapes, tag-resolution conventions, or domain primitives. This package fills that gap:

• Typed inputs/outputs — no untyped JSON wrangling
• Tag-name resolution — pass severity: 'bug', the SDK looks up the tag ID
• Sensible defaults — resourceType: 'feedback' is set automatically for feedback.create()
• One auth path — PAT in once, used for every call

Authentication

Generate a Personal Access Token (PAT) in your LaunchSecure organization settings, scoped to the projects/operations you need (e.g., write access to your central feedback project). Pass it to the client constructor.

The SDK never logs the PAT and never persists it — it's held in memory only.

Future surface (not implemented yet)

client.workItems.create({...});
client.workItems.list({...});
client.comments.create({...});
client.comments.list({...});
client.board.get({...});
client.tags.list({...});
client.tags.create({...});

These will be added as consumers need them.

License

MIT