[STG-2485] chore: point registry + Gemini extension at the hosted MCP

[shrey150]

⚠️ DRAFT — overnight autonomous change; needs Shrey review before it goes anywhere near the registry. Nothing was published — this is a code/metadata change only. mcp-publisher publish was not run.

Linear: STG-2485

What

Make the hosted server the primary, supported way to use the Browserbase MCP server across our public listing metadata, and stop presenting self-hosting as the recommended path.

• server.json
  • Bump version 2.2.0 → 3.0.0 to match package.json (which is already 3.0.0).
  • Add a remotes array with the hosted server: [{ "type": "streamable-http", "url": "https://mcp.browserbase.com/mcp" }].
  • Remove the npm + OCI packages entries so the registry surfaces the hosted remote as the way to use it.
• gemini-extension.json
  • Switch mcpServers.mcp-server-browserbase from stdio (npx @browserbasehq/mcp) to the hosted remote: { "httpUrl": "https://mcp.browserbase.com/mcp" }.
  • Bump version 2.4.1 → 3.0.0; add a description.
• README.md
  • Strengthen the top-of-file framing to unambiguous: this repo is the OSS reference implementation, use the hosted server at https://mcp.browserbase.com/mcp, and self-hosting is not officially supported.

Why

mcp.browserbase.com/mcp is the product. The npm/OCI package is an open-source reference implementation — self-hosting is not something we push. Public listings (the MCP registry entry via server.json, and the Gemini CLI extension) should be remote-primary: present the hosted URL, not a self-host package.

No changeset

This changes registry metadata (server.json), the Gemini extension config, and docs (README.md). It does not change the published @browserbasehq/mcp npm package's runtime behavior, so per repo convention no changeset was added.

Schema correctness

The MCP server.json schema (2025-07-09) marks only name, description, version as required at the ServerDetail level — packages is optional. A remote-only server (no packages) is valid. Verified by validating the edited server.json against the official schema with ajv (2020-12 + draft-07 meta), result VALID: true (see matrix).

E2E Test Matrix

Command / flow	Observed output	Confidence / sufficiency
jq . server.json	Parses; .version = 3.0.0, .remotes[0].type = streamable-http, .remotes[0].url = https://mcp.browserbase.com/mcp, .packages = null	Proves the file is valid JSON and has exactly the intended remote + no packages.
ajv validate edited server.json vs official MCP 2025-07-09 server schema (2020-12 + draft-07 meta, ajv-formats)	VALID: true	Proves the remote-only entry (no packages) conforms to the registry schema — i.e. removing packages is legal and no package entry is required.
jq . gemini-extension.json	Parses; .version = 3.0.0, .mcpServers["mcp-server-browserbase"].httpUrl = https://mcp.browserbase.com/mcp	Proves the extension JSON is valid and points at the hosted remote via the correct httpUrl field (Gemini CLI uses httpUrl for streamable HTTP, url only for SSE).
gemini extensions validate <tmp dir with gemini-extension.json> (gemini CLI 0.19.4)	Extension … has been successfully validated. (exit 0)	Proves the extension manifest is accepted by the real Gemini CLI validator, not just JSON-valid.
npx prettier@3 --check server.json gemini-extension.json README.md	All matched files use Prettier code style!	Proves formatting matches repo style (husky/lint-staged pre-commit also ran clean on commit).

On mcp-publisher validate

The official MCP registry publisher (mcp-publisher) is a Go binary distributed via GitHub releases and is not installed here. The npm package literally named mcp-publisher (0.4.2) is an unrelated third-party browser-automation tool, not the registry CLI — so it was deliberately not run. Schema conformance is instead proven directly via ajv against the official schema (row 2). No publish of any kind was performed.

Decision points for review

• Removed packages entirely (chose the "demote self-hosting" branch). The schema allows a remote-only server, so this is valid. If we'd rather still list the npm package but keep remotes primary (belt-and-suspenders for registry consumers that key off packages), that's a one-line add-back — flagging it as a judgment call.
• Versions bumped to 3.0.0 to match package.json. If the registry version is meant to track the listing rather than the package, revisit.

🤖 Generated with Claude Code