@booyaka/mcp-vet 0.2.0

package/dist/suppress.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseSuppressions = parseSuppressions;
+const types_1 = require("./types");
+const ALL = new Set(types_1.ALL_PATTERN_IDS);
+const DIRECTIVE_RE = /mcp-vet-disable-(file|next-line|line)\b([^\r\n]*)/g;
+function parseIds(trailing) {
+    const ids = new Set();
+    for (const tok of trailing.toUpperCase().match(/[A-Z0-9_]+/g) ?? []) {
+        if (ALL.has(tok))
+            ids.add(tok);
+    }
+    return ids; // empty => all patterns
+}
+/**
+ * Parse inline suppression directives from a file's raw lines. Recognized in any
+ * comment style (they are matched textually):
+ *   mcp-vet-disable-file
+ *   mcp-vet-disable-line [PATTERN_ID ...]
+ *   mcp-vet-disable-next-line [PATTERN_ID ...]
+ */
+function parseSuppressions(lines) {
+    let fileDisabled = false;
+    const byLine = new Map();
+    const add = (line, ids) => {
+        const existing = byLine.get(line);
+        if (!existing) {
+            byLine.set(line, ids);
+            return;
+        }
+        if (existing.size === 0)
+            return; // already "all"
+        if (ids.size === 0) {
+            byLine.set(line, new Set()); // widen to all
+            return;
+        }
+        ids.forEach((i) => existing.add(i));
+    };
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        DIRECTIVE_RE.lastIndex = 0;
+        let m;
+        while ((m = DIRECTIVE_RE.exec(line)) !== null) {
+            const kind = m[1];
+            const ids = parseIds(m[2]);
+            if (kind === 'file')
+                fileDisabled = true;
+            else if (kind === 'line')
+                add(i + 1, ids);
+            else if (kind === 'next-line')
+                add(i + 2, ids);
+        }
+    }
+    return {
+        fileDisabled,
+        byLine,
+        isSuppressed(line, id) {
+            if (fileDisabled)
+                return true;
+            const ids = byLine.get(line);
+            if (!ids)
+                return false;
+            return ids.size === 0 || ids.has(id);
+        },
+    };
+}

package/dist/ts-analyzer.js

@@ -0,0 +1,216 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeTs = analyzeTs;
+const ts_morph_1 = require("ts-morph");
+let project = null;
+let counter = 0;
+const CAP = new Set(['roots', 'sampling', 'logging']);
+const INIT_STRINGS = new Set(['initialize', 'notifications/initialized']);
+function getProject() {
+    if (!project) {
+        project = new ts_morph_1.Project({
+            useInMemoryFileSystem: true,
+            skipAddingFilesFromTsConfig: true,
+            compilerOptions: {
+                allowJs: true,
+                noLib: true, // pure syntactic extraction — no type checking / lib needed
+            },
+        });
+    }
+    return project;
+}
+function scanExtension(absPath) {
+    const p = absPath.toLowerCase();
+    if (p.endsWith('.tsx'))
+        return '.tsx';
+    if (p.endsWith('.jsx'))
+        return '.jsx';
+    if (p.endsWith('.mts') || p.endsWith('.cts'))
+        return '.ts';
+    if (p.endsWith('.js') || p.endsWith('.mjs') || p.endsWith('.cjs'))
+        return '.js';
+    return '.ts';
+}
+function safePropName(node) {
+    const pa = node.asKind(ts_morph_1.SyntaxKind.PropertyAssignment) ??
+        node.asKind(ts_morph_1.SyntaxKind.ShorthandPropertyAssignment);
+    try {
+        return pa?.getName();
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Is `node` structurally inside a `capabilities` object / call argument? */
+function isInCapabilities(node) {
+    let depth = 0;
+    for (const anc of node.getAncestors()) {
+        if (depth++ > 12)
+            break;
+        const k = anc.getKind();
+        if (k === ts_morph_1.SyntaxKind.PropertyAssignment || k === ts_morph_1.SyntaxKind.ShorthandPropertyAssignment) {
+            if (safePropName(anc) === 'capabilities')
+                return true;
+        }
+        else if (k === ts_morph_1.SyntaxKind.VariableDeclaration) {
+            try {
+                if (anc.asKind(ts_morph_1.SyntaxKind.VariableDeclaration).getName() === 'capabilities')
+                    return true;
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        else if (k === ts_morph_1.SyntaxKind.CallExpression || k === ts_morph_1.SyntaxKind.NewExpression) {
+            const expr = anc.getExpression?.();
+            if (expr && /capabilit/i.test(expr.getText()))
+                return true;
+        }
+    }
+    return false;
+}
+/** Is this string literal used like a registered method name? */
+function isRegistrationContext(node) {
+    const parent = node.getParent();
+    if (!parent)
+        return false;
+    // switch (x) { case 'initialize': }
+    if (parent.getKind() === ts_morph_1.SyntaxKind.CaseClause)
+        return true;
+    // x.method === 'initialize'
+    if (parent.getKind() === ts_morph_1.SyntaxKind.BinaryExpression) {
+        const be = parent.asKind(ts_morph_1.SyntaxKind.BinaryExpression);
+        const op = be.getOperatorToken().getKind();
+        if (op === ts_morph_1.SyntaxKind.EqualsEqualsEqualsToken || op === ts_morph_1.SyntaxKind.EqualsEqualsToken) {
+            const left = be.getLeft();
+            const other = left.getStart() === node.getStart() ? be.getRight() : left;
+            if (/method|type/i.test(other.getText()))
+                return true;
+        }
+    }
+    // { method: 'initialize' }
+    if (parent.getKind() === ts_morph_1.SyntaxKind.PropertyAssignment) {
+        const pa = parent.asKind(ts_morph_1.SyntaxKind.PropertyAssignment);
+        try {
+            if (pa.getInitializer()?.getStart() === node.getStart() &&
+                /^(method|type|name)$/i.test(pa.getName())) {
+                return true;
+            }
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    // server.setRequestHandler('initialize', handler)
+    let cur = node;
+    for (let i = 0; i < 4 && cur; i++) {
+        const p = cur.getParent();
+        if (!p)
+            break;
+        if (p.getKind() === ts_morph_1.SyntaxKind.CallExpression) {
+            const call = p.asKind(ts_morph_1.SyntaxKind.CallExpression);
+            const isArg = call
+                .getArguments()
+                .some((a) => a.getStart() === cur.getStart() && a.getEnd() === cur.getEnd());
+            if (isArg) {
+                const exprText = call.getExpression().getText();
+                if (/handler|handle|register|method|route|request|notification|(^|\.)on$/i.test(exprText)) {
+                    return true;
+                }
+            }
+            break;
+        }
+        cur = p;
+    }
+    return false;
+}
+/**
+ * Parse a TypeScript/JavaScript file with ts-morph and emit normalized tokens:
+ * string literals, numeric literals (with sign), identifiers, and object keys —
+ * annotated with structural capability context and registration context.
+ */
+function analyzeTs(absPath, text) {
+    const proj = getProject();
+    const ext = scanExtension(absPath);
+    const sf = proj.createSourceFile(`__scan_${counter++}${ext}`, text, { overwrite: true });
+    const tokens = [];
+    const posOf = (node) => {
+        try {
+            const { line, column } = sf.getLineAndColumnAtPos(node.getStart());
+            return { line, col: column };
+        }
+        catch {
+            return { line: node.getStartLineNumber(), col: undefined };
+        }
+    };
+    try {
+        sf.forEachDescendant((node) => {
+            const kind = node.getKind();
+            if (kind === ts_morph_1.SyntaxKind.StringLiteral ||
+                kind === ts_morph_1.SyntaxKind.NoSubstitutionTemplateLiteral) {
+                let value;
+                try {
+                    value = node.getLiteralValue();
+                }
+                catch {
+                    const raw = node.getText();
+                    value = raw.length >= 2 ? raw.slice(1, -1) : raw;
+                }
+                const { line, col } = posOf(node);
+                const tok = { kind: 'string', value, line, col };
+                if (CAP.has(value))
+                    tok.inCapabilities = isInCapabilities(node);
+                if (INIT_STRINGS.has(value))
+                    tok.registration = isRegistrationContext(node);
+                tokens.push(tok);
+                return;
+            }
+            if (kind === ts_morph_1.SyntaxKind.NumericLiteral) {
+                const raw = node.getText();
+                let value = raw;
+                const parent = node.getParent();
+                if (parent && parent.getKind() === ts_morph_1.SyntaxKind.PrefixUnaryExpression) {
+                    const pu = parent.asKind(ts_morph_1.SyntaxKind.PrefixUnaryExpression);
+                    if (pu && pu.getOperatorToken() === ts_morph_1.SyntaxKind.MinusToken)
+                        value = '-' + raw;
+                }
+                const { line, col } = posOf(node);
+                tokens.push({ kind: 'number', value, line, col });
+                return;
+            }
+            if (kind === ts_morph_1.SyntaxKind.Identifier) {
+                const { line, col } = posOf(node);
+                tokens.push({ kind: 'name', value: node.getText(), line, col });
+                return;
+            }
+        });
+        // Object literal keys (roots:, "sampling":, logging shorthand, ...)
+        const emitKey = (nameNode, value) => {
+            const { line, col } = posOf(nameNode);
+            const tok = { kind: 'key', value, line, col };
+            if (CAP.has(value))
+                tok.inCapabilities = isInCapabilities(nameNode);
+            tokens.push(tok);
+        };
+        for (const pa of sf.getDescendantsOfKind(ts_morph_1.SyntaxKind.PropertyAssignment)) {
+            try {
+                emitKey(pa.getNameNode(), pa.getName());
+            }
+            catch {
+                /* computed / unusual key */
+            }
+        }
+        for (const sp of sf.getDescendantsOfKind(ts_morph_1.SyntaxKind.ShorthandPropertyAssignment)) {
+            try {
+                emitKey(sp.getNameNode(), sp.getName());
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+    finally {
+        proj.removeSourceFile(sf);
+    }
+    return tokens;
+}

package/dist/types.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALL_PATTERN_IDS = void 0;
+exports.ALL_PATTERN_IDS = [
+    'MCP_SESSION_ID',
+    'INITIALIZE_HANDLER',
+    'ERROR_CODE_32002',
+    'TASKS_LEGACY',
+    'ROOTS_CAP',
+    'SAMPLING_CAP',
+    'LOGGING_CAP',
+];

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@booyaka/mcp-vet",
+  "version": "0.2.0",
+  "description": "Scan MCP server source code for patterns that break under the 2026-07-28 Model Context Protocol spec release candidate.",
+  "type": "commonjs",
+  "bin": {
+    "mcp-vet": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "author": "Booyaka101 <cbosch101@gmail.com>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Booyaka101/mcp-vet.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Booyaka101/mcp-vet/issues"
+  },
+  "homepage": "https://github.com/Booyaka101/mcp-vet#readme",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "linter",
+    "static-analysis",
+    "migration",
+    "breaking-changes",
+    "2026-07-28",
+    "sarif",
+    "ci",
+    "ast",
+    "cli",
+    "typescript",
+    "python"
+  ],
+  "license": "MIT",
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node scripts/copy-assets.mjs",
+    "prepare": "npm run build",
+    "test": "npm run build && node --test test/scan.test.mjs"
+  },
+  "dependencies": {
+    "chalk": "^4.1.2",
+    "commander": "^12.1.0",
+    "ts-morph": "^23.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.14.0",
+    "typescript": "^5.5.4"
+  }
+}