Summary

All four cross-cutting engineering prep items from the Cline, Smithery and Kiro Marketplaces — MCP Server Listing Plan, No code changes. Four commits: one per concern, plus the README revert.

1. Licence field: ISC → AGPL-3.0-only (0d33a38)

• package.json declares "license": "ISC", while the repo's LICENSE file is the full GNU AGPL-3.0 text and GitHub detects the project as AGPL-3.0.
• The ISC value dates from the initial commit (19 Apr 2025) and is the npm init default; the AGPL LICENSE was added deliberately three days later. The field was never updated.
• Today the npm page for @browserstack/mcp-server shows ISC, so downstream consumers and marketplace reviewers see a licence that contradicts the repo.
• Sets the SPDX identifier AGPL-3.0-only in package.json and the lockfile's root entry.

2. 400×400 icon (e92772c)

• Adds assets/icon-400.png: the official BrowserStack mark at 400×400, RGBA, transparent background, ~51 KB.
• Source is the BrowserStack GitHub org avatar (460×460), downscaled with Lanczos. Not an upscale of the existing 200×200 file, which is the generic MCP glyph rather than the BrowserStack brand.
• Cline's submission hard-requires a 400×400 PNG; Kiro and Smithery listings also show an icon. Once merged, this file's raw GitHub URL is what the Cline issue (fix(security): encode tool-argument IDs in API URL paths (block path-segment injection) #468 refresh), the Kiro feature request, and the Smithery listing will reference.

3. llms-install.md (22f1289)

• Agent-oriented install guide at the repo root. Cline's reviewers test that Cline can set the server up from the README or llms-install.md alone; our README is 800+ lines and mixes marketing with setup.
• Covers the hosted remote (https://mcp.browserstack.com/mcp, Streamable HTTP, OAuth discovery) and the local npx -y @browserstack/mcp-server@latest stdio install, each with configs for generic clients, VS Code and Kiro; optional env vars; a verification step; troubleshooting.

4. server.json remotes entry (22f1289)

• Adds {"type": "streamable-http", "url": "https://mcp.browserstack.com/mcp"}. Registry mirrors (GitHub MCP Registry, Kiro) only advertise the npm install today.
• Validated locally against the 2025-10-17 server.schema.json with ajv.
• Checked the registry's validator: remotes only need HTTPS, no localhost, no template variables. There is no namespace/domain ownership check for remotes, so publishing under io.github.browserstack/* with a mcp.browserstack.com URL is fine and the release-time mcp-publisher publish step is unaffected.

5. README "Add to Kiro" links: moved to #463

Originally in commit 22f1289, reverted in f404f88. The Kiro links conflicted with the README rewrite in #457 and featuring a new client in the README is a product call, so they now ride the stacked README PR #463 where product can weigh in. The Kiro install config stays in llms-install.md here.

Review note

The licence change alters the string published to npm on the next release, so it should get a Legal/manager sign-off before merge. If the intended licence is in fact ISC, the correct fix is instead to replace the LICENSE file.

Not in this PR

• Cline re-test from a fresh VS Code using only llms-install.md (QA step). Worth doing on this branch before the Cline issue is refreshed.
• Smithery static server card at /.well-known/mcp/server-card.json. Lives in the remote-mcp-server wrapper and is only needed if Smithery's OAuth-aware scan fails; the hosted endpoint already returns the correct 401 + WWW-Authenticate and both well-known OAuth documents.
• LICENSE has no BrowserStack copyright line and the README has no License section; cheap follow-ups once the licence is confirmed.

Test plan

• npm run build passes (no source changes)
• npm pack --dry-run shows the manifest with AGPL-3.0-only
• assets/icon-400.png previews correctly on GitHub at 400×400
• mcp-publisher publish succeeds on the next tag with the new remotes entry
• Fresh Cline install from llms-install.md alone connects and runs a tool

🤖 Generated with Claude Code