feat(dynamic-yield): add Dynamic Yield MCP

[JonasJesus42]

What

New dynamic-yield MCP (deco HTTP server) wrapping the public Dynamic Yield server-side APIs, published to the store via registry.json.

Tool	DY API
DY_CHOOSE	POST /v2/serve/user/choose: campaign/recommendation QA, dyApiPreview tokens, analytics metadata; no implicit pageview by default
DY_TRACK_PAGEVIEW / DY_TRACK_EVENTS / DY_TRACK_ENGAGEMENT	/v2/collect/user/{pageview,event,engagement} (descriptions warn they write real data)
DY_FEED_BULK	POST /v2/feeds/{feedId}/bulk: update / partial / delete, 1 to 100 actions (destructive hint)
DY_FEED_TRANSACTION_STATUS	GET /v2/feeds/{feedId}/transaction/{id}[/item/{sku}]
DY_USER_PROFILE	Profile Anywhere GET /v2/userprofile (optional separate key)

Dynamic Yield has no public API for campaigns, audiences, strategies or reports, so those stay in the DY console.

Auth: needs reviewer sign-off

The DY server-side API key is the connection token (app.json auth.type: token), read from MESH_REQUEST_CONTEXT.authorization. Because Authorization carries the upstream key, there is no shared secret for withAuth; dynamic-yield is added to auth-exemptions.json like perplexity and strapi. Tools use createPrivateTool. Configuration: region (us / eu) and optional profileAnywhereKey.

Wiring

• Root package.json workspace, deploy.json (kubernetes-bun, sites-dynamic-yield.deco.site), bun.lock.
• registry.json regenerated with bun run build:registry (117 public items, deco/dynamic-yield listed).
• Icon: the official Dynamic Yield GitHub org avatar (verified HTTP 200 image/png).

Verification

• bun run fmt --check, bun run lint, bun run check:registry, scripts/check-auth.ts, scripts/check.ts dynamic-yield, scripts/test.ts dynamic-yield: all pass (lint warnings are in other MCPs).
• server/lib/client.test.ts: region to base URL, Bearer stripping and missing key, error mapping with DY-Trace-ID, array responses, feed bulk schema limits (over 100, update without data, bad feed id, empty).
• Local server: tools/list returns the 7 tools.
• Live DY endpoints called with a fake key return 401, surfaced with the trace id.
• Studio catalog parser (parseCatalog) accepts the regenerated registry.json and finds deco/dynamic-yield.
• Not run: calls with a real DY key (no account access yet).

🤖 Generated with Claude Code

---

Summary by cubic

Adds a dynamic-yield MCP to the store wrapping Dynamic Yield's public server-side APIs, with 7 tools covering campaign and recommendation QA, event tracking, product feed sync, and profile reads.

Auth

• The connection token is the DY server-side API key, forwarded on the Authorization header, so there's no shared secret for withAuth; dynamic-yield joins auth-exemptions.json alongside perplexity and strapi. That exemption is the main reviewer decision.

Notes

• DY_FEED_BULK modifies the live catalog used by recommendations, and the tracking tools write real analytics data — the tool descriptions warn to use test users.
• Configuration sets the data center region (us/eu) and optionally a Profile Anywhere key; campaigns, audiences, strategies, and reports have no public API and stay in the DY console.

^{Written for commit bc67f7d. Summary will update on new commits.}