Add Nora MCP server

[solomon2773]

Summary

• Add @noraai/mcp-server v0.1.3 as an npx-packaged MCP server.
• Document its GitHub Actions/npm provenance.
• Provide obvious mock Nora credentials so CI can discover and scan the default tool catalog without contacting a real Nora deployment.

Nora operates self-hosted agent fleets across Docker and Kubernetes. Its default MCP catalog exposes 15 operational and monitoring tools; destructive agent deletion is not enabled by default.

Package links

• npm: https://www.npmjs.com/package/@noraai/mcp-server/v/0.1.3
• Source: https://github.com/solomon2773/nora
• Provenance publish run: https://github.com/solomon2773/nora/actions/runs/29171838525

Validation

• dockhand verify-provenance -c npx/nora/spec.yaml -v — detected npm attestations and matched the expected repository.
• npm audit signatures — verified registry signatures for 94 installed packages and attestations for 8 packages.
• dockhand build -c npx/nora/spec.yaml --check-provenance — passed and generated the expected non-root Node container definition.
• Cisco AI Defense mcp-scanner 4.7.5 using the CI config-file path and both mock_env values — passed; 15 tools scanned, zero findings.
• Docker image build plus a second scan of the built image — passed; 15 tools scanned, zero findings.
• go test ./... — passed.

Note: Dockyard currently detects the npm attestation bundle but logs a multi-attestation parsing warning (unknown field "attestations"). The independent npm audit above cryptographically verifies the published package's registry signatures and provenance attestations.