@booyaka/mcp-vet 0.2.0

package/dist/constants.js

@@ -0,0 +1,60 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CHANGELOG_URL = exports.SPEC_URL = exports.SPEC_DATE = void 0;
+exports.getVersion = getVersion;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+exports.SPEC_DATE = 'July 28, 2026';
+exports.SPEC_URL = 'https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/';
+exports.CHANGELOG_URL = 'https://tokenmix.ai/blog/mcp-updates-changelog-every-protocol-change-2026';
+/** Resolve the package version from package.json, tolerating layout differences. */
+function getVersion() {
+    const candidates = [
+        path.join(__dirname, '..', 'package.json'), // dist/ -> package.json
+        path.join(__dirname, '..', '..', 'package.json'),
+    ];
+    for (const c of candidates) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(c, 'utf8'));
+            if (pkg && typeof pkg.version === 'string')
+                return pkg.version;
+        }
+        catch {
+            /* try next */
+        }
+    }
+    return '0.0.0';
+}

package/dist/ignore.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IgnoreMatcher = void 0;
+/**
+ * Minimal gitignore-flavored glob matcher (no external deps). Supports `*`,
+ * `**`, `?`, leading `/` anchoring, trailing `/`, and bare basename patterns.
+ * Patterns and paths are matched in posix form.
+ */
+function compile(pattern) {
+    let p = pattern.trim();
+    if (!p || p.startsWith('#'))
+        return null;
+    const anchored = p.startsWith('/');
+    if (anchored)
+        p = p.slice(1);
+    if (p.endsWith('/'))
+        p = p.slice(0, -1);
+    if (!p)
+        return null;
+    let re = '';
+    for (let i = 0; i < p.length; i++) {
+        const c = p[i];
+        if (c === '*' && p[i + 1] === '*') {
+            if (p[i + 2] === '/') {
+                re += '(?:.*/)?';
+                i += 2;
+            }
+            else {
+                re += '.*';
+                i += 1;
+            }
+        }
+        else if (c === '*') {
+            re += '[^/]*';
+        }
+        else if (c === '?') {
+            re += '[^/]';
+        }
+        else if ('\\^$+.()|{}[]'.includes(c)) {
+            re += '\\' + c;
+        }
+        else {
+            re += c;
+        }
+    }
+    const hasSlash = p.includes('/');
+    const full = anchored || hasSlash ? `^${re}(?:/.*)?$` : `(?:^|/)${re}(?:/.*)?$`;
+    try {
+        return new RegExp(full);
+    }
+    catch {
+        return null;
+    }
+}
+class IgnoreMatcher {
+    constructor(patterns) {
+        this.regexes = patterns.map(compile).filter((r) => r !== null);
+    }
+    get size() {
+        return this.regexes.length;
+    }
+    matches(relPosixPath) {
+        return this.regexes.some((r) => r.test(relPosixPath));
+    }
+}
+exports.IgnoreMatcher = IgnoreMatcher;

package/dist/py-analyzer.js

@@ -0,0 +1,114 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findPython = findPython;
+exports.pythonAvailable = pythonAvailable;
+exports.analyzePyBatch = analyzePyBatch;
+const node_child_process_1 = require("node:child_process");
+const path = __importStar(require("node:path"));
+let cachedPython = undefined;
+/** Locate a usable Python 3 interpreter, trying platform-appropriate names. */
+function findPython() {
+    if (cachedPython !== undefined)
+        return cachedPython;
+    if (process.env.MCP_VET_NO_PYTHON) {
+        // Escape hatch: force the regex fallback (also used to test that path).
+        cachedPython = null;
+        return null;
+    }
+    if (process.env.MCP_VET_PYTHON) {
+        cachedPython = process.env.MCP_VET_PYTHON;
+        return cachedPython;
+    }
+    const candidates = process.platform === 'win32'
+        ? ['python', 'py', 'python3']
+        : ['python3', 'python'];
+    for (const c of candidates) {
+        try {
+            const r = (0, node_child_process_1.spawnSync)(c, ['--version'], { encoding: 'utf8' });
+            if (!r.error &&
+                (r.status === 0 || `${r.stdout}${r.stderr}`.toLowerCase().includes('python'))) {
+                cachedPython = c;
+                return c;
+            }
+        }
+        catch {
+            /* try next */
+        }
+    }
+    cachedPython = null;
+    return null;
+}
+const SCRIPT = path.join(__dirname, 'python', 'mcp_ast_scan.py');
+const CHUNK_SIZE = 300;
+function pythonAvailable() {
+    return findPython() !== null;
+}
+function runChunk(py, files) {
+    const out = {};
+    const r = (0, node_child_process_1.spawnSync)(py, [SCRIPT], {
+        input: files.join('\n'),
+        encoding: 'utf8',
+        maxBuffer: 256 * 1024 * 1024,
+    });
+    if (r.error || r.status !== 0 || !r.stdout)
+        return out;
+    try {
+        const parsed = JSON.parse(r.stdout);
+        for (const [f, toks] of Object.entries(parsed))
+            out[f] = toks;
+    }
+    catch {
+        /* malformed output — treat chunk as no findings */
+    }
+    return out;
+}
+/**
+ * Analyze a batch of Python files via the bundled subprocess script. Files are
+ * processed in chunks so a single pathological file can only lose its own chunk,
+ * and so stdin/stdout stay well under buffer limits on large repos.
+ * Returns a map of absolute-file-path -> tokens.
+ */
+function analyzePyBatch(absFiles) {
+    const out = {};
+    const py = findPython();
+    if (!py || absFiles.length === 0)
+        return out;
+    for (let i = 0; i < absFiles.length; i += CHUNK_SIZE) {
+        const chunk = absFiles.slice(i, i + CHUNK_SIZE);
+        Object.assign(out, runChunk(py, chunk));
+    }
+    return out;
+}

package/dist/py-fallback.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.regexFallbackTokens = regexFallbackTokens;
+/**
+ * Degraded, regex-based tokenizer for Python source, used ONLY when no Python
+ * interpreter is available. It cannot verify AST structure, so capability
+ * findings fall back to the line-proximity heuristic (medium confidence) and it
+ * may over-report inside comments/docstrings. Deterministic string/number rules
+ * (session id, initialize, -32002, tasks/*) remain reliable.
+ */
+function regexFallbackTokens(text) {
+    const tokens = [];
+    const lines = text.split(/\r?\n/);
+    const strRe = /(['"])((?:\\.|(?!\1).)*)\1/g;
+    const numRe = /-?\b\d+\b/g;
+    const idRe = /[A-Za-z_][A-Za-z0-9_]*/g;
+    const capKeyRe = /\b(roots|sampling|logging)\s*[:=]/g;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const ln = i + 1;
+        let m;
+        strRe.lastIndex = 0;
+        while ((m = strRe.exec(line)) !== null) {
+            tokens.push({ kind: 'string', value: m[2], line: ln, col: m.index + 1 });
+        }
+        numRe.lastIndex = 0;
+        while ((m = numRe.exec(line)) !== null) {
+            tokens.push({ kind: 'number', value: m[0], line: ln, col: m.index + 1 });
+        }
+        idRe.lastIndex = 0;
+        while ((m = idRe.exec(line)) !== null) {
+            const v = m[0];
+            // Only names that can matter to a rule (keeps the token list small).
+            if (/mcpsessionid/i.test(v)) {
+                tokens.push({ kind: 'name', value: v, line: ln, col: m.index + 1 });
+            }
+        }
+        capKeyRe.lastIndex = 0;
+        while ((m = capKeyRe.exec(line)) !== null) {
+            tokens.push({ kind: 'key', value: m[1], line: ln, col: m.index + 1 });
+        }
+    }
+    return tokens;
+}

package/dist/python/mcp_ast_scan.py

@@ -0,0 +1,183 @@
+#!/usr/bin/env python3
+"""Bundled Python AST scanner for mcp-vet.
+
+Reads a newline-separated list of file paths on stdin, parses each with
+``ast.parse`` and emits normalized tokens the Node rule engine consumes. Output
+is a single JSON object mapping each file path to its list of tokens:
+
+    {"/abs/path.py": [{"kind": "string", "value": "...", "line": 12, "col": 5}, ...]}
+
+Token kinds match the TypeScript analyzer: "string", "number", "name", "key".
+Capability keys carry ``inCapabilities`` (structurally inside a ``capabilities``
+object/kwarg) and ``initialize`` strings carry ``registration`` (used like a
+registered method name), so the engine can assign confidence uniformly.
+"""
+import ast
+import json
+import re
+import sys
+
+sys.setrecursionlimit(20000)
+
+CAP = {"roots", "sampling", "logging"}
+INIT_STRINGS = {"initialize", "notifications/initialized"}
+HANDLERISH = re.compile(r"handler|handle|register|route|request|notification|method|^on$", re.I)
+METHODISH = ("method", "type")
+
+
+def _is_int_constant(node):
+    return (
+        isinstance(node, ast.Constant)
+        and isinstance(node.value, int)
+        and not isinstance(node.value, bool)
+    )
+
+
+def _col(node):
+    c = getattr(node, "col_offset", None)
+    return (c + 1) if isinstance(c, int) else None
+
+
+def _mentions_method(o):
+    if isinstance(o, ast.Attribute):
+        return o.attr.lower() in METHODISH
+    if isinstance(o, ast.Name):
+        return o.id.lower() in METHODISH
+    if isinstance(o, ast.Subscript):
+        s = o.slice
+        if isinstance(s, ast.Index):  # py<3.9 compatibility
+            s = s.value
+        if isinstance(s, ast.Constant) and isinstance(s.value, str):
+            return s.value.lower() in METHODISH
+    return False
+
+
+def _func_is_handlerish(func):
+    name = ""
+    if isinstance(func, ast.Attribute):
+        name = func.attr
+    elif isinstance(func, ast.Name):
+        name = func.id
+    return bool(HANDLERISH.search(name))
+
+
+def _is_registration(node):
+    p = getattr(node, "parent", None)
+    if p is None:
+        return False
+    if isinstance(p, ast.Compare):
+        for o in [p.left, *p.comparators]:
+            if o is not node and _mentions_method(o):
+                return True
+    if isinstance(p, ast.Call) and node in p.args and _func_is_handlerish(p.func):
+        return True
+    if isinstance(p, ast.Dict):
+        try:
+            idx = p.values.index(node)
+        except ValueError:
+            idx = -1
+        if idx >= 0:
+            k = p.keys[idx]
+            if isinstance(k, ast.Constant) and isinstance(k.value, str):
+                if k.value.lower() in ("method", "type", "name"):
+                    return True
+    return False
+
+
+class Scanner:
+    def __init__(self):
+        self.tokens = []
+
+    def emit_for(self, node, in_caps):
+        if isinstance(node, ast.Constant):
+            if isinstance(node.value, str):
+                tok = {"kind": "string", "value": node.value, "line": node.lineno, "col": _col(node)}
+                if node.value in CAP:
+                    tok["inCapabilities"] = in_caps
+                if node.value in INIT_STRINGS:
+                    tok["registration"] = _is_registration(node)
+                self.tokens.append(tok)
+            elif _is_int_constant(node):
+                self.tokens.append(
+                    {"kind": "number", "value": str(node.value), "line": node.lineno, "col": _col(node)}
+                )
+        elif isinstance(node, ast.UnaryOp) and isinstance(node.op, ast.USub) and _is_int_constant(node.operand):
+            op = node.operand
+            self.tokens.append(
+                {"kind": "number", "value": str(-op.value), "line": op.lineno, "col": _col(node)}
+            )
+        elif isinstance(node, ast.Name):
+            self.tokens.append({"kind": "name", "value": node.id, "line": node.lineno, "col": _col(node)})
+        elif isinstance(node, ast.Attribute):
+            self.tokens.append({"kind": "name", "value": node.attr, "line": node.lineno, "col": _col(node)})
+
+    def visit(self, node, in_caps):
+        self.emit_for(node, in_caps)
+
+        if isinstance(node, ast.Dict):
+            for k, v in zip(node.keys, node.values):
+                if k is not None:
+                    self.visit(k, in_caps)
+                    if isinstance(k, ast.Constant) and isinstance(k.value, str):
+                        tok = {"kind": "key", "value": k.value, "line": k.lineno, "col": _col(k)}
+                        if k.value in CAP:
+                            tok["inCapabilities"] = in_caps
+                        self.tokens.append(tok)
+                child_caps = in_caps or (isinstance(k, ast.Constant) and k.value == "capabilities")
+                self.visit(v, child_caps)
+            return
+
+        if isinstance(node, ast.Call):
+            self.visit(node.func, in_caps)
+            for a in node.args:
+                self.visit(a, in_caps)
+            for kw in node.keywords:
+                if kw.arg is not None:
+                    line = getattr(kw, "lineno", None) or getattr(kw.value, "lineno", 0)
+                    tok = {"kind": "key", "value": kw.arg, "line": line, "col": _col(kw)}
+                    if kw.arg in CAP:
+                        tok["inCapabilities"] = in_caps
+                    self.tokens.append(tok)
+                child_caps = in_caps or (kw.arg == "capabilities")
+                self.visit(kw.value, child_caps)
+            return
+
+        for child in ast.iter_child_nodes(node):
+            self.visit(child, in_caps)
+
+
+def scan_source(src):
+    try:
+        tree = ast.parse(src)
+    except (SyntaxError, ValueError):
+        return []
+    for n in ast.walk(tree):
+        for c in ast.iter_child_nodes(n):
+            c.parent = n
+    scanner = Scanner()
+    try:
+        scanner.visit(tree, False)
+    except RecursionError:
+        pass
+    return scanner.tokens
+
+
+def main():
+    data = sys.stdin.read()
+    files = [line for line in data.splitlines() if line.strip()]
+    result = {}
+    for f in files:
+        try:
+            # utf-8-sig strips a leading BOM (common on Windows-authored files);
+            # a BOM left in the source makes ast.parse raise SyntaxError.
+            with open(f, "r", encoding="utf-8-sig", errors="replace") as fh:
+                src = fh.read()
+        except OSError:
+            result[f] = []
+            continue
+        result[f] = scan_source(src)
+    sys.stdout.write(json.dumps(result))
+
+
+if __name__ == "__main__":
+    main()