Add a standard steel section catalog

.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{ts,js,json}]
+indent_style = space
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.yml]
+indent_style = space
+indent_size = 2

.github/workflows/ci.yml

@@ -5,6 +5,10 @@ on:
     branches: [main]
   pull_request:
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
 jobs:
   verify:
     name: verify on Node ${{ matrix.node-version }}
@@ -36,14 +40,22 @@ jobs:
       - name: Build
         run: npm run build
 
-      - name: Verify the demo runs
-        run: npm run demo
-
-      - name: Verify the CLI list pipes to standard output
+      - name: Verify the CLI contract
         run: |
-          node dist/index.js --version
+          node dist/index.js --version | grep -q "^engineer-mcp"
           node dist/index.js --list | grep -q "beam_bending"
+          node dist/index.js --list | grep -q "section_catalog"
           node dist/index.js --list | grep -q "interference_fit"
+          node dist/index.js --list | grep -q "fatigue_analysis"
+          node dist/index.js --transport http --list | grep -q "beam_bending"
+          OUTPUT="$(node dist/index.js --transport unknown 2>&1 || true)"
+          echo "$OUTPUT" | grep -q "Unknown transport"
+
+      - name: Verify the demo runs
+        run: npm run demo
+
+      - name: Verify the HTTP transport
+        run: npm run smoke:http
 
       - name: Verify the package contents
         run: npm pack --dry-run

CONTRIBUTING.md

@@ -0,0 +1,56 @@
+# Contributing
+
+Thanks for helping Engineer MCP. Read the boundary rules in `docs/integration.md` before you start. They keep the project focused and compatible.
+
+## Project layout
+
+| Path | Role |
+| --- | --- |
+| `src/engine/` | Pure calculation functions. |
+| `src/units/` | Dimension-safe unit conversion. |
+| `src/db/` | SQLite schema and seeding. |
+| `src/handlers.ts` | Tool orchestration and result envelopes. |
+| `data/` | Material, fastener, section, and reference data. |
+| `tests/` | Deterministic test suite. |
+
+## Setup
+
+Install Node.js 22.13 or newer.
+
+Run `npm install` to install dependencies.
+
+## Checks
+
+Run these checks before you submit a change:
+
+1. Run `npm run typecheck`.
+2. Run `npm test`.
+3. Run `npm run build`.
+4. Run `npm run demo`.
+
+The test suite is deterministic and offline.
+It needs no API keys and no network access.
+
+## Conventions
+
+Use SI base units inside calculations.
+Express every quantity with a unit string.
+Keep the calculator logic separate from the MCP binding.
+Return source references with every computed result.
+Never invent references. Use only cited standards and texts.
+Do not add comments unless they explain a non-obvious decision.
+
+## Data changes
+
+The data files in `data/` are the single source of truth.
+The database seeds from these files on first start.
+Do not edit the generated SQLite file directly.
+Audit any new catalog values against a cited source.
+Add a deterministic test that covers the new values.
+
+## Releases
+
+This server follows semantic versioning.
+Adding a tool or a unit is a minor version bump.
+Breaking a tool signature or the result envelope requires a major version bump.
+Update the roadmap when you complete a planned item.

README.md

@@ -10,7 +10,6 @@ It gives coding agents verified answers for beams, bolts, springs, shafts, beari
 Every result shows the formula, the method, and the source.
 
 ## What it provides
-
 Use Engineer MCP inside an AI coding agent.
 The agent calls a tool and receives a complete engineering answer.
 The answer includes numbers, units, assumptions, and citations.
@@ -23,10 +22,16 @@ The release covers these domains:
 - Shaft torsion and first critical speed.
 - Bearing rating life to ISO 281.
 - von Mises equivalent stress.
+- Fatigue analysis for cyclic loads.
 - Cross-section properties.
 - Press and shrink fit analysis by Lamé theory.
-- Dimension-safe unit conversion.
+- Standard steel section catalog to EN 10365.
+  The catalog returns the separate source for published section properties.
+- Bearer authentication and browser origin allow-lists for HTTP clients.
+- Dimension-safe unit conversion, including viscosity and thermal conductivity.
 - Material property lookup.
+- Stdio and HTTP transports.
+  The HTTP mode serves the same tools over the Streamable HTTP protocol.
 
 ## How results stay trustworthy
 
@@ -55,10 +60,15 @@ Warnings surface when a method uses an approximation.
 | `shaft_analysis` | Torsion stress, twist, and critical speed. |
 | `bearing_life` | ISO 281 rating life in revolutions and hours. |
 | `von_mises` | Equivalent stress and yield safety factor. |
+| `fatigue_analysis` | Endurance limit and fatigue safety factor for cyclic loads. |
 | `unit_convert` | Conversion between compatible units. |
 | `material_lookup` | Curated mechanical properties of materials. |
+| `section_catalog` | Published IPE, HEA, HEB, and UPN steel sections. |
 
 See [docs/mcp-tools.md](docs/mcp-tools.md) for the full reference.
+See [docs/section-catalog.md](docs/section-catalog.md) for the covered range, the value provenance, and the data audit.
+See [docs/units.md](docs/units.md) for the unit model and the full category list.
+See [docs/transport.md](docs/transport.md) for the HTTP transport reference.
 
 ## Architecture
 
@@ -69,7 +79,9 @@ The database seeds from JSON files on first start.
 
 ```mermaid
 flowchart LR
-  Agent[AI coding agent] -->|MCP over stdio| Server[MCP server]
+  Agent[AI coding agent] -->|stdio| Server[MCP server]
+  Agent -->|HTTP| Security[HTTP security policy]
+  Security --> Server
   Server --> Tools[Tools layer]
   Tools --> Engines[Calculation engines]
   Tools --> Units[Unit layer]
@@ -85,7 +97,10 @@ Key directories:
 | `src/units/` | Dimension-safe unit conversion. |
 | `src/db/` | SQLite schema and seeding. |
 | `src/handlers.ts` | Tool orchestration and result envelopes. |
-| `data/` | Material, fastener, and reference data. |
+| `src/http.ts` | Streamable HTTP transport and session registry. |
+| `src/http-security.ts` | Bearer authentication and browser-origin policy. |
+| `src/index.ts` | CLI entry point and transport selection. |
+| `data/` | Material, fastener, section, and reference data. |
 
 ## Quick start
 
@@ -99,6 +114,9 @@ The demo prints results for every tool.
 It runs against an in-memory database.
 It needs no API keys and no network access.
 
+Configure HTTP authentication with `ENGINEER_MCP_AUTH_TOKEN`.
+Configure browser access with `ENGINEER_MCP_ALLOWED_ORIGINS`.
+
 ## Run as an MCP server
 
 Run the server over standard input and output.
@@ -112,6 +130,22 @@ See [examples/mcp-config.example.json](examples/mcp-config.example.json) for a t
 Set `ENGINEER_MCP_DB` or pass `--db <path>` to choose the database file.
 The default database file is `engineer-mcp.sqlite` in the working directory.
 
+## Run over HTTP
+
+Run the server with the HTTP transport.
+
+```sh
+node dist/index.js --transport http
+```
+
+The server listens on `http://127.0.0.1:3000/mcp`.
+Set `--host` and `--port` to change the bind address.
+Set `ENGINEER_MCP_TRANSPORT`, `ENGINEER_MCP_HOST`, and `ENGINEER_MCP_PORT` to configure the same values.
+See [docs/transport.md](docs/transport.md) for client configuration and curl examples.
+
+Use a port of `0` to let the operating system choose a free port.
+The server prints the real port to standard error.
+
 ## Sample output
 
 A call to `beam_bending` with a 20 kN point load on a 3 m S355 I-beam:
@@ -169,13 +203,95 @@ References:
   - Theory of Elasticity (Lamé solution for thick-walled cylinders)
 ```
 
+A call to `fatigue_analysis` for a ground steel part at 90% reliability with a 120 MPa alternating stress on an 80 MPa mean stress:
+
+```text
+Endurance limit                        280.5 MPa
+Static yield safety factor                2.9
+Fatigue safety factor                   1.839
+
+Method: Fatigue analysis by endurance limit and mean-stress criterion
+Formula: Se' = 0.5 Sut for steel, Se = ka kb kc kd ke kf Se', 1/n = sigma_a/Se + sigma_m/Sut
+References:
+  - Shigley's Mechanical Engineering Design (Tenth edition, 2015)
+```
+
 A call to `unit_convert` with a torque-to-energy request fails safely:
 
 ```text
 Error: Category mismatch: N·m is torque, J is energy.
 Use a unit of the same quantity.
 ```
 
+A call to `unit_convert` for a 100 cP lubricant converts to the SI unit:
+
+```text
+Converted value                       0.1 Pa·s
+  Value of 100 cP expressed in Pa·s.
+  Value of 100 cP in the SI base unit Pa·s.
+Factor: 0.001 (dynamic viscosity)
+```
+
+A call to `unit_convert` for copper with 401 W/(m·K) converts to the imperial unit:
+
+```text
+Converted value                       231.7 BTU/(ft·h·°F)
+  Value of 401 W/(m·K) expressed in BTU/(ft·h·°F).
+  Value of 401 W/(m·K) in the SI base unit W/(m·K).
+Factor: 1 (thermal conductivity)
+```
+
+A call to `section_catalog` for the HEB series returns the published sections:
+
+```text
+Rows:
+  - HEB 100 | h 100 mm | I 450 cm4 | W 89.9 cm3 | 20.4 kg/m
+  - HEB 120 | h 120 mm | I 864 cm4 | W 144 cm3 | 26.7 kg/m
+  - HEB 140 | h 140 mm | I 1509 cm4 | W 216 cm3 | 33.7 kg/m
+  - HEB 160 | h 160 mm | I 2492 cm4 | W 311 cm3 | 42.6 kg/m
+
+Method: Standard section catalog lookup
+References:
+  - EN 10365 - Hot rolled steel channels, I and H sections - Dimensions and masses
+  - European sections - dimensions and section properties
+```
+
+Pass a catalog designation to `beam_bending` to use the published section properties:
+
+```text
+Maximum bending moment                   15 kN·m
+Maximum bending stress                26.93 MPa
+Maximum deflection                   0.6411 mm
+Bending safety factor                 13.18
+
+References:
+  - Roark's Formulas for Stress and Strain (Eighth edition, 2011)
+  - Mechanics of Materials (Euler-Bernoulli beam theory)
+  - EN 10365 - Hot rolled steel channels, I and H sections - Dimensions and masses
+  - European sections - dimensions and section properties
+```
+
+The same tools run over HTTP.
+Start the server with `--transport http`, then start a session with curl:
+
+```sh
+curl -s -D - http://127.0.0.1:3000/mcp \
+  -H "content-type: application/json" \
+  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}'
+```
+
+The response carries the session id in the `Mcp-Session-Id` header.
+Send that header on every later request:
+
+```sh
+curl -s http://127.0.0.1:3000/mcp \
+  -H "content-type: application/json" \
+  -H "mcp-session-id: <session id>" \
+  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'
+```
+
+See [docs/transport.md](docs/transport.md) for the full HTTP reference.
+
 ## Development
 
 | Command | Purpose |
@@ -184,17 +300,21 @@ Use a unit of the same quantity.
 | `npm test` | Run the deterministic test suite. |
 | `npm run build` | Emit `dist/` from `src/`. |
 | `npm run demo` | Run the end-to-end demo. |
+| `npm run smoke:http` | Run the HTTP transport smoke check. |
 | `npm run dev` | Start the server from source. |
 
 ## Test status
 
 The test suite is deterministic and offline.
-It covers the engines, the unit layer, the database, and the tools.
+It covers the engines, the unit layer, the database, the tools, the catalog data, and the HTTP transport.
 
-- 109 tests across 11 files.
+- 185 tests across 15 files.
 - All tests pass on Node 22 and Node 24.
-- The CI workflow runs typecheck, tests, build, demo, and a package check.
-- The CI workflow verifies that the CLI tool list pipes to standard output.
+- The HTTP tests run a real server on an ephemeral port.
+  They complete the full handshake over a real TCP connection.
+- The CI workflow runs typecheck, tests, build, demo, a package check, and the HTTP smoke check.
+- The CI workflow verifies the CLI contract over standard output.
+- The CI workflow verifies both transport modes.
 
 Run `npm test` to reproduce the results.
 
@@ -207,8 +327,25 @@ Run `npm test` to reproduce the results.
 - The critical speed is a first-mode approximation.
 - The spring design covers static round-wire springs only.
   It does not estimate fatigue life for cyclic loads.
+  Use the `fatigue_analysis` tool for a separate cyclic-load check.
+- The fatigue analysis estimates the endurance limit for steel only.
+  The tool applies to infinite-life design and does not model finite-life crack growth.
+  Surface and reliability factors follow the standard table values.
 - The press-fit theory assumes elastic material behavior and uniform friction.
   It does not model residual stress after yield.
+- The section catalog covers common IPE, HEA, HEB, and UPN sizes.
+  It does not include every size in the standard.
+- The viscosity and thermal conductivity units cover common engineering units.
+  They do not cover every named unit in older texts.
+- The HTTP transport binds to the local host by default.
+  Authentication is optional.
+  Set `ENGINEER_MCP_AUTH_TOKEN` before a protected deployment.
+- Browser clients need an explicit origin allow-list.
+  Set `ENGINEER_MCP_ALLOWED_ORIGINS` with comma-separated origins.
+  The transport does not provide TLS.
+  Use a reverse proxy for public deployment.
+- The HTTP transport keeps session state in memory.
+  A restart clears every active session.
 - The built-in SQLite module of Node.js is still experimental.
 
 Check the cited sources for exact values.
@@ -222,15 +359,30 @@ Each release stays useful on its own.
 
 - Helical compression spring design.
   The `spring_design` tool reports the spring rate, the shear stress, and the safety factor.
+- Standard steel section catalog.
+  The `section_catalog` tool searches the published IPE, HEA, HEB, and UPN series.
+  The `beam_bending` and `section_properties` tools accept a catalog designation.
+  The result cites EN 10365 for dimensions and masses.
+  It cites ArcelorMittal for section properties.
 - Press and shrink fit analysis.
   The `interference_fit` tool reports the interface pressure, the hoop stresses, and the friction capacity.
+- Fatigue analysis.
+  The `fatigue_analysis` tool estimates the endurance limit for steel and reports the fatigue safety factor for a selected mean-stress criterion.
+- Viscosity and thermal conductivity units.
+  The `unit_convert` tool converts dynamic viscosity, kinematic viscosity, and thermal conductivity.
+  The registry covers centipoise, centistokes, and the imperial conductivity units.
+- HTTP transport.
+  The server runs over stdio or Streamable HTTP.
+  The `--transport http` option starts an HTTP endpoint with stateful sessions.
+- HTTP transport security.
+  The server supports bearer authentication.
+  It rejects browser origins outside the configured allow-list.
 
 ### Remaining
 
-- Add fatigue analysis for cyclic loads.
-- Add more unit categories, including viscosity and thermal conductivity.
-- Add HTTP transport.
-- Add a catalog of ISO and DIN standard sections.
+- Make the HTTP response mode configurable.
+  The server returns JSON responses today.
+  An SSE-only client needs an explicit streaming mode.
 
 See [docs/integration.md](docs/integration.md) for the EngineerKit plan.