@booyaka/mcp-vet 0.7.0 → 0.8.0

package/README.md

@@ -387,8 +387,8 @@ jobs:
   vet:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with: { node-version: '20' }
       - run: npx @booyaka/mcp-vet . --github-annotations
 ```
@@ -399,7 +399,7 @@ To upload results to GitHub code scanning instead:
 
 ```yaml
       - run: npx @booyaka/mcp-vet . --sarif mcp-vet.sarif --fail-on none
-      - uses: github/codeql-action/upload-sarif@v3
+      - uses: github/codeql-action/upload-sarif@v4
         with: { sarif_file: mcp-vet.sarif }
 ```
 

package/dist/cli.js

@@ -103,7 +103,17 @@ if (process.argv[2] === 'fixtures') {
 // server/discover, resource error code). `run` is an alias for `probe`.
 // Async, so the scan pipeline only runs in the else-branch.
 if (process.argv[2] === 'probe' || process.argv[2] === 'run') {
-    (0, probe_cli_1.runProbeCli)(process.argv.slice(3)).then((code) => process.exit(code), (err) => fail(err.message));
+    (0, probe_cli_1.runProbeCli)(process.argv.slice(3)).then((code) => {
+        // Calling process.exit() the moment the probe resolves tears the process
+        // down while undici's keep-alive sockets and the AbortSignal.timeout timer
+        // are still closing. On Windows that trips a libuv assertion
+        // (!(handle->flags & UV_HANDLE_CLOSING)) and the process dies with
+        // 0xC0000409 instead of the intended exit code. Set exitCode and let the
+        // loop drain instead; the unref'd fallback stops a lingering socket from
+        // ever hanging CI.
+        process.exitCode = code;
+        setTimeout(() => process.exit(code), 2000).unref();
+    }, (err) => fail(err.message));
 }
 else {
     scanMain();

package/dist/colors.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A tiny ANSI colouriser standing in for chalk.
+ *
+ * chalk 5+ is ESM-only. This package compiles to CommonJS, so `import chalk from
+ * 'chalk'` fails to typecheck (TS2307) and `require('chalk')` only works on Node
+ * versions with require(esm) — it broke on Node 20. The surface actually used here
+ * is seven colours plus `.bold` chaining, which is not worth a dependency.
+ */
+/** A callable style that can also be chained, e.g. `c.red.bold('x')`. */
+export type Style = ((text: string) => string) & {
+    bold: (text: string) => string;
+};
+export interface Colors {
+    red: Style;
+    green: Style;
+    yellow: Style;
+    cyan: Style;
+    gray: Style;
+    bold: Style;
+    underline: Style;
+}
+/**
+ * `level` mirrors chalk's: 0 disables colour, anything higher enables it.
+ * When omitted, colour is auto-detected the way chalk does — a TTY on stdout,
+ * unless NO_COLOR is set or the terminal is `dumb`.
+ */
+export declare function createColors(level?: number): Colors;

package/dist/colors.js

@@ -0,0 +1,60 @@
+"use strict";
+/**
+ * A tiny ANSI colouriser standing in for chalk.
+ *
+ * chalk 5+ is ESM-only. This package compiles to CommonJS, so `import chalk from
+ * 'chalk'` fails to typecheck (TS2307) and `require('chalk')` only works on Node
+ * versions with require(esm) — it broke on Node 20. The surface actually used here
+ * is seven colours plus `.bold` chaining, which is not worth a dependency.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createColors = createColors;
+const ESC = String.fromCharCode(27);
+const CODES = {
+    reset: 0,
+    bold: 1,
+    red: 31,
+    green: 32,
+    yellow: 33,
+    cyan: 36,
+    gray: 90,
+    underline: 4,
+};
+function wrap(enabled, codes) {
+    if (!enabled || codes.length === 0)
+        return (text) => text;
+    const open = codes.map((c) => `${ESC}[${c}m`).join('');
+    const close = `${ESC}[${CODES.reset}m`;
+    return (text) => open + text + close;
+}
+function style(enabled, name) {
+    const base = wrap(enabled, [CODES[name]]);
+    base.bold = wrap(enabled, [CODES[name], CODES.bold]);
+    return base;
+}
+/**
+ * `level` mirrors chalk's: 0 disables colour, anything higher enables it.
+ * When omitted, colour is auto-detected the way chalk does — a TTY on stdout,
+ * unless NO_COLOR is set or the terminal is `dumb`.
+ */
+function createColors(level) {
+    const enabled = level === undefined ? autoDetect() : level > 0;
+    return {
+        red: style(enabled, 'red'),
+        green: style(enabled, 'green'),
+        yellow: style(enabled, 'yellow'),
+        cyan: style(enabled, 'cyan'),
+        gray: style(enabled, 'gray'),
+        bold: style(enabled, 'bold'),
+        underline: style(enabled, 'underline'),
+    };
+}
+function autoDetect() {
+    if (process.env.NO_COLOR !== undefined && process.env.NO_COLOR !== '')
+        return false;
+    if (process.env.FORCE_COLOR !== undefined && process.env.FORCE_COLOR !== '0')
+        return true;
+    if (process.env.TERM === 'dumb')
+        return false;
+    return Boolean(process.stdout && process.stdout.isTTY);
+}

package/dist/reporters.js

@@ -32,9 +32,6 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.reportTerminal = reportTerminal;
 exports.renderMarkdown = renderMarkdown;
@@ -48,17 +45,17 @@ exports.writeSarif = writeSarif;
 exports.reportProbeTerminal = reportProbeTerminal;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
-const chalk_1 = __importDefault(require("chalk"));
+const colors_1 = require("./colors");
 const types_1 = require("./types");
 const rules_1 = require("./rules");
 const constants_1 = require("./constants");
 function makeChalk(color) {
     // color === true -> force on; false -> force off; undefined -> auto-detect
     if (color === true)
-        return new chalk_1.default.Instance({ level: 1 });
+        return (0, colors_1.createColors)(1);
     if (color === false)
-        return new chalk_1.default.Instance({ level: 0 });
-    return new chalk_1.default.Instance({});
+        return (0, colors_1.createColors)(0);
+    return (0, colors_1.createColors)();
 }
 function indent(text, pad) {
     return text

package/package.json

@@ -1,72 +1,71 @@
-{
-  "name": "@booyaka/mcp-vet",
-  "version": "0.7.0",
-  "description": "Scan MCP server source code for patterns that break under the 2026-07-28 Model Context Protocol spec release candidate.",
-  "type": "commonjs",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "sideEffects": false,
-  "bin": {
-    "mcp-vet": "dist/cli.js"
-  },
-  "files": [
-    "dist",
-    "schema",
-    "README.md",
-    "CHANGELOG.md",
-    "BENCHMARK.md",
-    "LICENSE"
-  ],
-  "engines": {
-    "node": ">=18"
-  },
-  "author": "Booyaka101 <cbosch101@gmail.com>",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Booyaka101/mcp-vet.git"
-  },
-  "bugs": {
-    "url": "https://github.com/Booyaka101/mcp-vet/issues"
-  },
-  "homepage": "https://github.com/Booyaka101/mcp-vet#readme",
-  "publishConfig": {
-    "access": "public"
-  },
-  "keywords": [
-    "mcp",
-    "model-context-protocol",
-    "linter",
-    "static-analysis",
-    "migration",
-    "breaking-changes",
-    "2026-07-28",
-    "sarif",
-    "ci",
-    "ast",
-    "cli",
-    "typescript",
-    "python"
-  ],
-  "license": "MIT",
-  "scripts": {
-    "build": "tsc -p tsconfig.json && node scripts/copy-assets.mjs",
-    "prepare": "npm run build",
-    "test": "npm run build && node --test test/scan.test.mjs test/probe.test.mjs"
-  },
-  "dependencies": {
-    "chalk": "^4.1.2",
-    "commander": "^12.1.0",
-    "ts-morph": "^23.0.0"
-  },
-  "devDependencies": {
-    "@types/node": "^20.14.0",
-    "typescript": "^5.5.4"
-  }
-}
+{
+  "name": "@booyaka/mcp-vet",
+  "version": "0.8.0",
+  "description": "Scan MCP server source code for patterns that break under the 2026-07-28 Model Context Protocol spec release candidate.",
+  "type": "commonjs",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "sideEffects": false,
+  "bin": {
+    "mcp-vet": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "schema",
+    "README.md",
+    "CHANGELOG.md",
+    "BENCHMARK.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "author": "Booyaka101 <cbosch101@gmail.com>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Booyaka101/mcp-vet.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Booyaka101/mcp-vet/issues"
+  },
+  "homepage": "https://github.com/Booyaka101/mcp-vet#readme",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "linter",
+    "static-analysis",
+    "migration",
+    "breaking-changes",
+    "2026-07-28",
+    "sarif",
+    "ci",
+    "ast",
+    "cli",
+    "typescript",
+    "python"
+  ],
+  "license": "MIT",
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node scripts/copy-assets.mjs",
+    "prepare": "npm run build",
+    "test": "npm run build && node --test test/scan.test.mjs test/probe.test.mjs"
+  },
+  "dependencies": {
+    "commander": "^15.0.0",
+    "ts-morph": "^28.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.1",
+    "typescript": "^5.5.4"
+  }
+}