hyperpolymath · hyperpolymath · Mar 13, 2026 · Mar 13, 2026
diff --git a/.clinerules b/.clinerules
diff --git a/.cursorrules b/.cursorrules
diff --git a/.github/workflows/zig-test.yml b/.github/workflows/zig-test.yml
@@ -27,7 +27,7 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Install Zig
-        uses: mlugg/setup-zig@v2
+        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
         with:
           version: 0.15.2
 

diff --git a/.maintenance-perms-ignore b/.maintenance-perms-ignore
diff --git a/.nojekyll b/.nojekyll
diff --git a/.windsurfrules b/.windsurfrules
diff --git a/CODEOWNERS b/CODEOWNERS
diff --git a/README.md b/README.md
@@ -6,6 +6,10 @@ Unified server capability catalogue with formally verified cartridges, distribut
 > `Set up Bundle of Joy Server from https://github.com/hyperpolymath/boj-server`
 > The AI reads this repo, asks you a few questions, and handles everything.
 
+<a href="https://glama.ai/mcp/servers/hyperpolymath/boj-server">
+  <img width="380" height="200" src="https://glama.ai/mcp/servers/hyperpolymath/boj-server/badge" alt="BoJ MCP Server on Glama" />
+</a>
+
 ## What is this?
 
 BoJ solves the **combinatoric explosion of developer server protocols**. Instead of hunting across dozens of MCP, LSP, DAP, and other servers, AI goes to ONE place — the Teranga menu — and orders what it needs.
@@ -93,9 +97,7 @@ cd ../../ffi/zig && zig build
 
 # Run tests
 cd ffi/zig && zig build test
-```<a href="https://glama.ai/mcp/servers/hyperpolymath/boj-server">
-  <img width="380" height="200" src="https://glama.ai/mcp/servers/hyperpolymath/boj-server/badge" />
-</a>
+```
 
 ## Distributed Hosting (Umoja Network)
 
@@ -126,7 +128,7 @@ PMPL-1.0-or-later (Palimpsest License). The license's provenance requirements (c
 
 ## Project Status
 
-**Grade A (Production)** — 18 cartridges, 307 tests passing, thread-safe FFI (mutex-hardened), panic-attack validated. See `READINESS.md` for the full CRG assessment and `.machine_readable/STATE.a2ml` for milestone progress.
+**Grade A (Production)** — 18 cartridges, 307 tests passing, thread-safe FFI (mutex-hardened), panic-attack validated. See `docs/READINESS.md` for the full CRG assessment and `.machine_readable/STATE.a2ml` for milestone progress.
 
 ## A Community Project
 

diff --git a/ABI-FFI-README.md → docs/ABI-FFI-README.md b/ABI-FFI-README.md → docs/ABI-FFI-README.md
diff --git a/READINESS.md → docs/READINESS.md b/READINESS.md → docs/READINESS.md
diff --git a/RSR_OUTLINE.adoc → docs/RSR_OUTLINE.adoc b/RSR_OUTLINE.adoc → docs/RSR_OUTLINE.adoc
diff --git a/TOPOLOGY.md → docs/TOPOLOGY.md b/TOPOLOGY.md → docs/TOPOLOGY.md
diff --git a/mcp-bridge/main.js b/mcp-bridge/main.js
@@ -106,9 +106,16 @@ async function fetchCartridges() {
   }
 }
 
+function isValidCartridgeName(name) {
+  return typeof name === "string" && /^[a-z0-9][a-z0-9-]*$/.test(name) && name.length <= 64;
+}
+
 async function invokeCartridge(name, params) {
+  if (!isValidCartridgeName(name)) {
+    return { error: `Invalid cartridge name: ${name}` };
+  }
   try {
-    const res = await fetch(`${BOJ_BASE}/cartridge/${name}/invoke`, {
+    const res = await fetch(`${BOJ_BASE}/cartridge/${encodeURIComponent(name)}/invoke`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(params || {}),
@@ -120,8 +127,11 @@ async function invokeCartridge(name, params) {
 }
 
 async function fetchCartridgeInfo(name) {
+  if (!isValidCartridgeName(name)) {
+    return { error: `Invalid cartridge name: ${name}` };
+  }
   try {
-    const res = await fetch(`${BOJ_BASE}/cartridge/${name}`);
+    const res = await fetch(`${BOJ_BASE}/cartridge/${encodeURIComponent(name)}`);
     return await res.json();
   } catch {
     const all = OFFLINE_MENU.tier_teranga.concat(OFFLINE_MENU.tier_shield);