[wxai-space]

Summary

• Preserve the original optional example and contributor commits from docs: add deed.page Streamable HTTP MCP publishing example #119.
• Store credentials outside the repository by default; enforce owner-only regular files and reject symlinks/FIFOs/insecure paths.
• Atomically publish 0600 token files without silently replacing another owner token, including concurrent destination changes.
• Reuse saved credentials per connection and add token_saved only after storage succeeds.
• Reserve the deedpage namespace, preserve local same-name tools, and keep credentials scoped to the intended server.
• Re-apply filtering and redaction after refresh or partial discovery failures; refuse replacing an existing MCP client.
• Ignore the legacy token filename and document POSIX file requirements and unverified live-service scope.

Testing

• Full tracked suite: 391 passed, 1 opt-in backend test skipped.
• Focused example/security tests: 26 passed.
• compileall and git diff --check passed.
• No model API or real deed.page publication was invoked for this revision.

Review and dependencies

Submitted for review only; no merge or release is requested. SDK 2.x service use requires the transport/schema compatibility fix proposed in #121. This PR remains based on main and retains attribution from #119.

[wxai-space]

Final integration acceptance: combined with #120 and #121, the suite passes 420 tests with one opt-in backend test skipped on both MCP 1.12.4 and 2.3.0. The four Python-version CI checks on #122 are green. No real publishing service was called, and no merge or release has been performed.

[wxai-space]

All fixes have now been fast-forwarded directly into the original PR #119 at 0957291. Its new CI run passed all 4 checks: https://github.com/wanxingai/LightAgent/actions/runs/40616543427 . Closing this supplemental PR as redundant, without merging or deleting its branch. Continue review in #119; main is unchanged.