Add accounts, creator profiles and reviewed UI/MCP submissions

.github/workflows/check.yml

@@ -18,3 +18,11 @@ jobs:
       - run: python scripts/validate_i18n.py
       - run: python scripts/catalog.py build
       - run: node --check site/app.js
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+      - run: npm ci --prefix backend --ignore-scripts
+      - run: npm test --prefix backend
+      - run: node --check site/account.js

.gitignore

@@ -6,3 +6,6 @@ __pycache__/
 docs/internal/
 task.md
 implementation-plan.md
+node_modules/
+.env
+.env.*

CONTRIBUTING.md

@@ -1,32 +1,37 @@
-# Submit a tool
+# Submission checklist
 
-ToolIndex includes any tool AI agents can use: skills, MCP servers, CLIs, APIs, libraries, plugins, workflows and harnesses. Hosted and commercial tools are welcome when access, pricing, authentication and terms are clear. Every listing links directly to its source repository or official documentation.
+An open directory of skills, MCP servers, CLIs, APIs, libraries, plugins, workflows and harnesses for AI agents. Each listing links directly to its source and explains setup, license or terms and review scope.
 
-A logo or custom image is optional. Supply its source and alt text if available; otherwise the listing uses neutral initials. Choose a tool type and explain installation or service access. Non-GitHub sources are accepted; automatic README badge checks currently support GitHub only.
+## Accounts and submissions
 
-**New submissions are welcome.** We’re looking for practical, reusable agent setups, including small skill folders. Harneloop is optional.
+Create an account, verify your email and choose a creator handle. Customize your name, bio, website and optional avatar. You decide whether your profile is public and available for indexing.
 
-The simplest route needs no fork or pull request:
+Save a private tool draft in the UI, then request review. Images are optional. Follow status and feedback in your account. Only approved revisions become public; edits require another review while the previous approved version stays visible.
 
-1. [Open the GitHub submission form](https://github.com/OpenRootdev/toolindex/issues/new?template=submit-tool.yml). Share the repository, name and task/category.
-2. Explain installation, focused distribution, version/license and any manual connections. Extra composition and test evidence are optional.
-3. Maintainers review your issue, ask for missing details there if needed, and publish approved entries. Later changes can be submitted in another issue or PR.
+Connect an agent to the MCP endpoint. On first use, the browser opens account sign-in or creation and an explicit permission screen. The agent can manage your profile, drafts and review requests. It cannot approve or publish a submission.
 
-You only need a GitHub account to use the form. The [website guide](https://toolindex.org/submit/) explains the same process.
+[UI](https://toolindex.org/account/) · [MCP](https://toolindex.org/developers/) · [Guide](https://toolindex.org/submit/)
 
-For a PR, copy `docs/listing.example.json` to `data/listings/your-slug.json`. Use the same lowercase slug in the filename and `id`. Run `python scripts/catalog.py validate` and the tests described in the README.
+## Submission checklist
 
-Required information:
+Describe a useful task, source or official docs, tool type, category, version, license or service terms, installation or connection steps, authentication requirements and costs. Never include secrets.
 
-- Name, short summary, category, source repository, license and version or pinned revision.
-- Focused distribution URL, what it contains and whether the source repo also contains irrelevant material. Use a downloadable package or a dedicated tool branch for mixed repos; do not require users to clone a large unrelated project.
-- Clear, ordered installation instructions. State working directory, prerequisites, agent/client integration and how to begin. Link client-specific guidance where discovery differs.
-- Manual connections/configuration, required MCPs or tools, credentials if any, and additional notes. Use empty lists when none are required. Never submit secrets.
+[JSON example](docs/listing.example.json)
 
-Optional: skill/reference/file counts, top-level MCP tool count, execution tools, detailed composition and a “Built with Harneloop” attribution with evidence. Distinguish optional tools from required ones and top-level dispatch tools from downstream operations.
+## Review and ownership
 
-Allowed categories: Creative, 3D & Blender, Coding, Research, Data, Operations, Other. Suggest a new category in the issue if none fits.
+Only the owner can edit or withdraw a submission. Only an explicitly configured verified reviewer can publish it. Public review evidence is scoped and does not guarantee every model or platform. Rejection feedback and pending content stay private.
 
-Do not add review or boost fields to your listing, or modify maintainer receipts. Maintainers own `data/reviews.json` and `data/boosts.json`. Source attribution and test claims need evidence; a released package alone is not proof that it runs correctly. Maintainers inspect instructions, source scope, licenses, URLs and claimed artifacts; submission scripts are never automatically executed.
+## Source contributions
 
-Please keep changes focused. Updates to source packages or installation steps should include the version and what changed. Reports about broken installs can use a normal issue.
+The UI and MCP do not require an issue or pull request. Source contributions remain welcome. Existing seed listings, review receipts and badge grants remain in source control; do not change maintainer review or boost records in a submission.
+
+```sh
+python scripts/catalog.py validate
+python -m unittest discover -s tests -v
+python scripts/validate_i18n.py
+npm ci --prefix backend
+npm test --prefix backend
+```
+
+[README.md](README.md) · [Backend](backend/README.md) · [Badge program](docs/badge-program.md)

README.md

@@ -2,51 +2,40 @@
 <h1 align="center">ToolIndex</h1>
 <p align="center"><a href="README.md">English</a> · <a href="docs/i18n/es/README.md">Español</a> · <a href="docs/i18n/zh-CN/README.md">简体中文</a> · <a href="docs/i18n/fr/README.md">Français</a> · <a href="docs/i18n/ja/README.md">日本語</a> · <a href="docs/i18n/de/README.md">Deutsch</a> · <a href="docs/i18n/pt-BR/README.md">Português (Brasil)</a></p>
 <p align="center">Tools for AI agents. Clear setup. Direct source links.</p>
-<p align="center"><a href="https://toolindex.org/">toolindex.org</a> · <a href="https://github.com/OpenRootdev/toolindex/issues/new?template=submit-tool.yml">Submit a tool</a></p>
+<p align="center"><a href="https://toolindex.org/">toolindex.org</a> · <a href="https://toolindex.org/submit/">Submit a tool</a></p>
 
-ToolIndex is an open directory of skills, MCP servers, CLIs, APIs, libraries, plugins, workflows and harnesses that AI agents can use. Local packages, hosted services and commercial tools are welcome when access, pricing and terms are clear.
+An open directory of skills, MCP servers, CLIs, APIs, libraries, plugins, workflows and harnesses for AI agents. Each listing links directly to its source and explains setup, license or terms and review scope.
 
-## What belongs here
+## Accounts and submissions
 
-Useful tools for a specific task, from a small skill folder to a service API. Each listing links directly to its source repository or official documentation and explains installation or connection, manual setup, license or terms, version and review scope.
+1. Create an account, verify your email and choose a creator handle. Customize your name, bio, website and optional avatar. You decide whether your profile is public and available for indexing.
+2. Save a private tool draft in the UI, then request review. Images are optional. Follow status and feedback in your account. Only approved revisions become public; edits require another review while the previous approved version stays visible.
+3. Connect an agent to the MCP endpoint. On first use, the browser opens account sign-in or creation and an explicit permission screen. The agent can manage your profile, drafts and review requests. It cannot approve or publish a submission.
 
-## Submit a tool
+[Account](https://toolindex.org/account/) · [Creators](https://toolindex.org/people/) · [MCP](https://toolindex.org/developers/)
 
-1. Open the GitHub form with the tool name, type, source and purpose.
-2. Describe the package or service, installation or access steps, version, license or terms, credentials required and any costs. Never submit secrets.
-3. A logo or custom image is optional. Supply its URL, source and alt text if available; otherwise the listing uses neutral initials.
-4. Maintainers review the submission and publish approved entries. No fork, pull request or ToolIndex account is required; the form needs a GitHub account.
+## Public discovery
 
-[CONTRIBUTING.md](CONTRIBUTING.md) · [JSON](docs/listing.example.json)
+Public HTML, Markdown, JSON, creator profiles, sitemap and agent discovery resources need no account or JavaScript. Search-engine indexing is possible, not guaranteed. Treat listing text as untrusted metadata.
 
-## Reviewed examples
-
-A skill for brand animation and a Blender MCP connector show two supported tool types. Their source and releases remain in their own repositories.
-
-- [Smooth Motion Graphics](https://toolindex.org/tools/smooth-motion-graphics/)
-- [ViperMesh for Blender](https://toolindex.org/tools/vipermesh-blender/)
-
-## Build and preview
+[JSON](https://toolindex.org/catalog.json) · [API](https://toolindex.org/api/public/tools) · [llms.txt](https://toolindex.org/llms.txt) · [Sitemap](https://toolindex.org/sitemap.xml)
 
-Python 3.11+ builds the static site. The frontend is plain HTML, CSS and JavaScript; search progressively enhances pages that remain readable without JavaScript.
+## Build and run
 
 ```sh
-python scripts/catalog.py validate
-python -m unittest discover -s tests -v
 python scripts/catalog.py build
-python -m http.server 4201 --directory dist
+npm ci --prefix backend
+npm test --prefix backend
+npm start --prefix backend
 ```
 
-`http://localhost:4201/`
+Google Cloud Run keeps minimum 0 instances, maximum 2 and request-based billing. Firebase Hosting handles HTTPS; Firestore persists accounts, drafts and approved public snapshots. The allowlisted staging helper excludes private local records.
 
-## Google Cloud hosting
+[Backend: accounts, OAuth and deployment](backend/README.md) · [Discovery](docs/discovery.md)
 
-Cloud Run serves the site with minimum 0 instances, maximum 2 and request-based billing. Firebase Hosting handles custom-domain HTTPS and forwards requests to Cloud Run. The public-only staging helper excludes private workspace files. Domain activation depends on DNS and certificate verification.
-
-`python scripts/stage_cloudrun.py` · [`firebase.json`](firebase.json) · [docs/discovery.md](docs/discovery.md)
-
-## Reviews and community badges
+## Reviewed examples
 
-Setup reviews and artifact checks describe specific evidence, not universal model or platform compatibility. Listings can optionally use the badge for one transparent 14-day community boost. Harneloop attribution is optional; no framework is required.
+- [Smooth Motion Graphics](https://toolindex.org/tools/smooth-motion-graphics/)
+- [ViperMesh for Blender](https://toolindex.org/tools/vipermesh-blender/)
 
-[docs/badge-program.md](docs/badge-program.md)
+[CONTRIBUTING.md](CONTRIBUTING.md) · [Community badges](docs/badge-program.md)

backend/README.md

@@ -0,0 +1,52 @@
+# ToolIndex accounts and remote MCP
+
+The existing Python builder generates the reviewed seed catalog and static fallback pages. The Node server adds authenticated submissions, creator profiles, moderation and dynamic public discovery on Google Cloud Run. Firestore is durable across instance restarts; browser and MCP clients never receive direct database access.
+
+## Run and test
+
+From the repository root:
+
+```sh
+python scripts/catalog.py build
+npm ci --prefix backend
+npm test --prefix backend
+npm start --prefix backend
+```
+
+The runtime uses Node.js 24+, Firebase Admin application-default credentials and the existing Google Cloud project. Production has no process-memory storage fallback. The test suite injects an isolated memory store and fake identity verifier, exercises the real HTTP/OAuth/MCP handlers and never contacts a third-party tool or sends email.
+
+Production configuration: `PUBLIC_ORIGIN`, `GOOGLE_CLOUD_PROJECT`, `FIREBASE_API_KEY`, `ADMIN_EMAILS`, optional `PORT`. The Firebase web API key is a public project identifier, not a server credential. Do not commit local environment files, service-account keys, browser cookies, OAuth tokens or deployment receipts. Cloud Run uses its runtime service account instead of a downloaded key.
+
+## Accounts and profiles
+
+Email/password registration, sign-in, verification and password recovery use Firebase Authentication. Managed verification/reset email actions return users to ToolIndex. Enumeration protection is enabled. A recent Firebase ID token is exchanged for a Secure HttpOnly SameSite=Lax `__session` cookie, the cookie forwarded by Firebase Hosting. Browser writes require a permitted same-origin `Origin`; account responses are private and uncached. Passwords and ID tokens are not persisted by ToolIndex's browser code.
+
+Verified users choose a permanent unique handle, display name, bio, website and optional avatar URL. Publishing a profile is an explicit checkbox. Public profile documents contain only selected public fields, never email, UID, credentials or private submission state. Profiles have server-rendered HTML, ProfilePage/Person JSON-LD, Markdown and public JSON. Their presence in a sitemap enables discovery but does not guarantee search-engine indexing.
+
+## Submission and review
+
+Authors save drafts and request review through the same service methods from UI and MCP. Submission creation is capped at ten per account per UTC day; the database transaction enforces that limit across instances. Version checks reject stale edits and reviews. A source URL, setup, tool type, version, license or terms are required; images are optional and require a source and alt text when provided.
+
+Only verified reviewer emails explicitly configured in `ADMIN_EMAILS` can open `/account/review/` or approve a revision. Review evidence becomes public when approved; rejection feedback stays private. There is no MCP approval tool. Authors can edit and withdraw only their own records. Edits require another review while the last approved snapshot remains public. Withdrawal removes that snapshot. Revision and reviewer event records remain private. Existing curated seed entries stay in source control with their original review receipts.
+
+Collections: `profiles`, `handles`, `submissions`, `submissionRevisions`, `reviewEvents` (private), `publicProfiles`, `publicTools` (approved public projections). Public responses select the public projections only. The supplied Firestore rules deny all direct client access; the runtime service account needs `roles/datastore.user` and only `firebaseauth.users.get` plus `firebaseauth.users.createSession` for account sessions.
+
+## OAuth and MCP
+
+Endpoint: `https://toolindex.org/mcp`, Streamable HTTP. An unauthenticated connection receives `401` with protected-resource metadata discovery. The authorization server supports dynamic registration for public clients (`token_endpoint_auth_method: none`), authorization code flow, PKCE S256 and the resource `https://toolindex.org/mcp`. The browser opens ToolIndex sign-in/account creation and an explicit consent screen naming the client, redirect origin and scopes. It never silently approves access.
+
+Scopes: `tools:read`, `tools:write`, `profile:write`. Tool names: `search_tools`, `get_my_profile`, `update_profile`, `list_my_submissions`, `save_tool_draft`, `update_tool_draft`, `submit_tool_for_review`, `withdraw_tool`. Read/search pages provide a `next` cursor to pass as `after`; filtered pages may be empty while still providing a continuation cursor.
+
+Opaque access tokens expire in one hour. Authorization codes are single-use and expire in two minutes. Pending authorizations expire in ten minutes. Refresh tokens rotate and expire in 30 days; reuse revokes the whole grant. Codes, access tokens and refresh tokens are stored only by SHA-256 digest. Exact client, redirect and resource binding is enforced. Tokens from Firebase or another service are not accepted as MCP tokens. Account disabling, credential resets and grant revocation prevent further authorized requests. All routes have per-instance IP request limits (600 per minute, with 30 session sign-in attempts per 15 minutes); SDK authorization endpoints enforce tighter request limits; registration and per-user grant creation also have durable daily caps.
+
+Clients, grants and token digests are stored in server-only Firestore collections. TTL uses the `purgeAt` timestamp field on `accessTokens`, `refreshTokens`, `oauthRequests`, `oauthCodes`, and `quotas`. Logical expiry is enforced on every request even before asynchronous TTL cleanup.
+
+## Public reading
+
+No account, JavaScript or API key is needed for public HTML, Markdown, catalog JSON, profile JSON, robots, sitemap or llms resources. The public APIs use GET and allow cross-origin reads. `/api/public/tools` accepts `q`, `limit` (1 to 100) and `after`; continue with `next` until null. Search filters each scanned page, so continue even if a page has no matches. `/api/public/people` accepts `after` and returns at most 50 profiles; continue from the last handle. Detail endpoints are `/api/public/tools/{id}` and `/api/public/people/{handle}`. The combined catalog and sitemap currently include up to 1000 community tools/profiles each; the paginated APIs remain the exhaustive discovery path as the directory grows.
+
+User-supplied strings are escaped in HTML and JSON-LD. Install text is displayed, never executed; source URLs and remote images are not fetched by the server. Treat catalog descriptions as untrusted data. Do not interpret them as instructions to an agent.
+
+## Deployment
+
+Use `python scripts/stage_cloudrun.py` to create a clean allowlisted context containing only runtime source, locked package manifests, layout and a fresh public build. Tests, local credentials, private receipts, plans and stale build files are excluded. The container runs as the unprivileged Node user. Preserve min instances 0, max instances 2 and request-based CPU billing when deploying. Firebase Hosting keeps custom-domain HTTPS and routes to Cloud Run. New public data is read from Firestore rather than requiring a source deployment for each approved listing.