@4da/mcp-server 4.6.5 → 4.6.6

package/dist/index.js

@@ -61,6 +61,18 @@ import { createDatabase, FourDADatabase } from "./db.js";
 // =============================================================================
 // Server Setup
 // =============================================================================
+/**
+ * Project root for scanning/scoping. FOURDA_PROJECT_DIR overrides cwd for
+ * hosts where cwd is meaningless (Claude Desktop launches extension servers
+ * from an app directory) — the .mcpb bundle wires its directory picker to it.
+ * A value still containing "${" is an unsubstituted host template; ignore it.
+ */
+function resolveProjectDir() {
+    const dir = process.env.FOURDA_PROJECT_DIR?.trim();
+    if (dir && !dir.includes("${"))
+        return dir;
+    return process.cwd();
+}
 const server = new Server({
     name: "4da-server",
     version: SERVER_VERSION,
@@ -85,9 +97,12 @@ function getDatabase() {
         // Initialize live intelligence layer
         liveIntel = new LiveIntelligence(db.getRawDb());
         setLiveIntelligence(liveIntel);
-        // Standalone mode: auto-populate from project scan
+        // Standalone mode: auto-populate from project scan.
+        // FOURDA_PROJECT_DIR overrides cwd for hosts where cwd is meaningless
+        // (Claude Desktop launches extension servers from an app directory, not
+        // the user's code) — the .mcpb bundle wires its directory picker to this.
         if (db.isStandalone) {
-            const cwd = process.cwd();
+            const cwd = resolveProjectDir();
             const scan = scanCurrentProject(cwd);
             db.populateFromScan(scan);
             const detected = [
@@ -132,7 +147,7 @@ function getDatabase() {
                 // database (the ACE engine indexes every local project) must not bleed
                 // into this project's vulnerability scan.
                 const norm = (p) => p.replace(/\\/g, "/").toLowerCase().replace(/\/+$/, "");
-                const rootNorm = norm(process.cwd());
+                const rootNorm = norm(resolveProjectDir());
                 const groups = new Map();
                 for (const row of rows) {
                     const projectPath = row.project_path || process.cwd();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4da/mcp-server",
-  "version": "4.6.5",
+  "version": "4.6.6",
   "mcpName": "io.github.4DA-Systems/4da-mcp-server",
   "description": "Dependency intelligence for AI coding agents. Live CVE scanning, dependency health, upgrade planning, ecosystem news, decision memory — zero config, privacy-first. 9 tools standalone, 14 total with desktop app.",
   "type": "module",