Add MetaScraper MCP app with native ChatGPT workflows and isolated Vercel hosting

[natalie-a-1]

MetaScraper lets users inspect and remove hidden photo metadata directly from a ChatGPT attachment, then save a verified cleaned copy. This adds the MCP app alongside the existing VS Code extension and includes its live Vercel hosting, shared Lucci Labs gateway, and isolated sandbox.

Changes

• Add Streamable HTTP and stdio MCP servers with original-attachment import, focused metadata questions, selective/full removal, expiring downloads, and explicit deletion. A discoverable workflow skill guides attachment-first use; the upload transport is private to the panel to avoid model-generated base64.
• Provide a compact, host-themed MCP Apps card with plain-language insights, progressive field disclosure, restrained cleanup motion, reduced-motion support, and recovery when a photo expires. Conversation cleanup renders the cleaned result without a second upload. A standalone picker remains available.
• Support JPEG, PNG, WebP, GIF, TIFF, HEIC, and HEIF. Reread cleaned outputs to verify removal, preserve original files, and cover encoded image data, pixels, animation, and structural metadata in regression tests.
• Deploy the Node/ExifTool server using Vercel container services and bounded, expiring Redis storage shared across instances. Multipart uploads and streamed downloads support photos up to 20 MiB. Restrict attachment downloads to verified OpenAI hosts and public IP addresses.
• Add production https://mcp.luccilabs.xyz/metascraper and sandbox https://sandbox.mcp.luccilabs.xyz/metascraper, with separate backends and databases. Preserve the legacy endpoint. Launch and Pilot are reserved slugs only.
• Document the shared registry, deployment conventions, pinned project/team deployment helper, and reusable agent prompt. Extend CI to cover infrastructure changes and both Dockerfiles.

Validation

• npm --prefix mcp run check: lint and widget build pass; 30 tests pass, with 3 external Redis tests skipped unless credentials are supplied. Those Redis tests previously passed against the dedicated store with isolated test prefixes.
• npm --prefix mcp audit --omit=dev --audit-level=high: zero vulnerabilities.
• node mcp/scripts/verify-environments.mjs: both public endpoints pass MCP/widget discovery, synthetic-photo inspection and cleanup, canonical downloads, pixel preservation, and cross-environment access rejection. A 6.3 MB cleaned PNG downloads successfully through the production gateway. Test photo handles are deleted afterward.
• Native authenticated ChatGPT acceptance completed in production and sandbox: composer attachment → cleanup → verified result card, without a second upload. Standalone browser and MCP Apps bridge flows were also exercised.

See mcp/VALIDATION.md for the detailed record. Native Claude acceptance remains outstanding. ChatGPT connections use developer mode; no public directory listing has been submitted. Hosting uses Vercel's container-image beta. Unrelated root extension dependency edits are excluded from this PR.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
metascraper	Ready	Preview	Sep 15, 2026 3:04am UTC

[natalie-a-1]

The MetaScraper MCP product backend was restored to production in PR #8, and shared gateway configuration now lives in lucci-xyz/mcp. This PR still contains the old infra/mcp-gateway copy plus separate VS Code extension changes. Please split or remove the superseded gateway files before merging this PR so it does not reintroduce a second route source. I am leaving the PR open because those extension changes have not been migrated or reviewed here.