mcp --http --public: key-less public server (skills, pitfalls, limits, listing lint, App Store search), rate limit, 64 KB bodies

docs/mcp.md

@@ -58,6 +58,44 @@ refused unless `--allow-origin` names it.
 - `project` may also be a folder name under the roots (a shared server keeps its checkouts there).
 - `/health` answers `{ ok, version }` without auth.
 
+
+## Public key-less server
+
+`storebound mcp --http --public [--port 7788] [--host 127.0.0.1] [--rate 60] [--trust-proxy]` is a separate mode for a
+server anyone may connect to (for example behind a public HTTPS address). No sign-in, no token, no project: it never
+reads store credentials, project folders or the working directory, never starts a child process and never runs the CLI.
+It is read-only and keeps no state. The only network call it makes is the public iTunes Search API (`aso_search`).
+It cannot be combined with `--auth`, `--token-file`, `--roots`, `--project`, `--broker-profiles`, `--allow-origin`
+or `--read-only`.
+
+Tools (and only these; the CLI tools of the normal server do not exist here, a call gets "Unknown tool"):
+
+- `skills_list`: name and one-line description of every skill in the package.
+- `skill_get {name}`: the full SKILL.md of one skill (`^[a-z0-9-]+$`, must be in the list).
+- `pitfalls_search {query, store?}`: the sections of the store-pitfalls skill that match the query words, best first (at
+  most 8, each clipped). `store` is `apple` or `play`.
+- `store_limits {store?}`: listing field character limits, the App Store keyword field rules, screenshot and app
+  preview sizes per device class, Play feature graphic and icon sizes.
+- `listing_lint {store, fields, locale?}`: storebound's listing and ASO checks on the text you send (limits, keyword
+  field rules, repeated name words, other platforms or apps named, placeholder text, keyword stuffing). Apple fields:
+  `name`, `subtitle`, `keywords`, `promotionalText`, `description`, `whatsNew`. Play fields: `title`,
+  `shortDescription`, `fullDescription`, `whatsNew`. Only the fields you send are judged; nothing is stored.
+- `aso_search {term, country?, limit?}`: top apps for a term in one storefront from the iTunes Search API (name,
+  developer, id, rating, rating count, genre; 1-25 results, 10 s timeout).
+
+Limits: `--rate N` requests per minute per client (default 60; over the limit the answer is 429 with `Retry-After`),
+bodies over 64 KB get 413, every tool input is validated against a closed schema, and output is bounded. Behind a
+reverse proxy add `--trust-proxy` so the first `X-Forwarded-For` entry is the client; without it that header is
+ignored. Any browser origin may call it (there is no ambient credential), and CORS preflight is answered. `/health`
+works as before. Request bodies are not logged.
+
+```bash
+storebound mcp --http --public --port 7788 --trust-proxy
+claude mcp add --transport http storebound-public https://mcp.example.com/mcp
+```
+
+For real store work (builds, uploads, listings, releases) use `npx storebound` and its own MCP server.
+
 ## Desktop machine interface
 
 `storebound serve --stdio` is what the desktop app (`apps/desktop`, in progress) runs as its sidecar: newline-delimited