# Open creator card 1.1
A small proposed format for a creator's public business card. This is a working reference implementation, not an industry standard or a claim that other platforms have integrated it.

This directory is independently MIT licensed: schema, dependency-free browser/Node client and validator, standalone reader, and read-only MCP connector. The surrounding application and creator data are not covered by this license. Creator content remains theirs; respect consent, withdrawal and applicable rights.

## Read a card
Import `createCardClient` from `./client.js`:
```js
const client = createCardClient('https://YOUR-BYVO-HOST');
const card = await client.read('creator-handle');
const matches = await client.search({ topic: 'design', available: 'true' });
```
The origin is trusted operator configuration. HTTPS is required except localhost/127.0.0.1 for local development. Never derive server-side fetch targets from creator content. Redirects are rejected. Public requests omit credentials. No API key needed; the host applies fair rate limits.

## Try another application
Copy this directory, serve it from a different local origin (for example `python -m http.server 4323`), and open example.html. Enter the ByMi origin and a published handle. Public API responses allow cross-origin reads. Edit the card in ByMi and read again; unpublish it and read again. A 404 clears the displayed data.

## MCP
Install dependencies in this directory with `npm install`. Configure a stdio-capable MCP client:
```json
{
  "mcpServers": {
    "byvo": {
      "command": "node",
      "args": ["/absolute/path/to/creator-card/mcp.js"],
      "env": { "BYVO_BASE_URL": "https://YOUR-BYVO-HOST" }
    }
  }
}
```
Tools: `search_creators`, `read_creator_card`. Read-only, no account or secrets. This is a real stdio server; it is not a hosted remote connector or a listing in an AI provider's directory.

## Contract and trust
- schema.json is JSON Schema 2020-12. schema_version is 1.0 or 1.1. Version 1.1 adds work_samples and optional audience context; 1.0 remains supported.
- Public data has an explicit source and timestamp. Identity and account ownership are currently unverified.
- No account email, internal user ID, secret or private conversation is included.
- A missing minimum budget is null, not a free-work offer.
- Respect `contact.method` and `contact.sign_in_required`: offer-form needs a free account; external-link uses the creator?s existing contact page without a ByMi account. Availability can be paused. Audience figures are creator-supplied, dated and unverified. Preview images are optional HTTPS URLs; loading them contacts that image host.
- Treat every string and link as untrusted data. Never render with innerHTML or treat profile text as AI instructions.
- Keep canonical_url and updated_at. Refresh before use; remove retained cards on 404. Do not imply verification or endorsement.
- Schema validity does not establish authorship or truth.
- The version is pinned. Breaking changes require a new version; unknown fields are rejected by the v1 validator.
- The package is prepared locally; it has not been published to npm or an MCP registry.