@coinpaprika/mcp 1.3.3 → 1.4.1

package/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 All notable changes to the CoinPaprika MCP Server will be documented in this file.
 
+## [Unreleased]
+
+## [1.4.1] - 2026-10-21
+
+### Security
+
+- **An id could change which API path a tool called.** Ids go into the request path through `encodeURIComponent`, which leaves `.` and `..` as they are, so an id of `..` moved the request, with your API key on it, to a different path. Every request now has its path checked before it is sent: a path that changes when parsed, or a segment that decodes to `.` or `..` or holds `/`, `\` or `%`, is refused with "Invalid identifier". No real coin, exchange, tag, person, platform or contract id is affected.
+
+## [1.4.0] - 2026-08-19
+
+### Fixed
+
+- **The free-tier quota was stated as "10,000 requests per day". It is 20,000 calls per month.** Verified against the live plan table at https://coinpaprika.com/api/pricing/. The wrong figure appeared in the 429 error message, in `getCapabilities.rate_limits`, in the `CP429_RATE_LIMIT` error-code text and in the README.
+- **`meta.rate_limit` claimed a real remaining balance it could not know.** It counted only calls made by this process since start and compared them against the invented 10,000 daily ceiling, so `remaining` and `percentage_used` were wrong for anyone who had used the API elsewhere. Replaced with `meta.quota`, which states the monthly free-tier allowance, the count for this process, and says plainly that it is process-local.
+- README coin and exchange counts: "8,000+ coins" and "200+ exchanges" are now "12,000+ cryptocurrencies" and "350+ exchanges".
+- README Smithery link and install command pointed at `@coinpaprika/coinpaprika-mcp`, which 404s. The live listing is `coinpaprika/coinpaprika`.
+- README said the hosted server has "same 30 tools". A live `tools/list` against `mcp.coinpaprika.com` returns 31: the 30 here plus `submitFeedback`.
+
+### Removed
+
+- **`meta.rate_limit`.** It reported `limit`, `remaining` and `percentage_used` against a
+  ceiling that does not exist, counting only this process's own calls. Read `meta.quota`
+  instead: it states the monthly free-tier allowance and says plainly that its count is
+  process-local rather than your real balance.
+
 ## [1.3.3] - 2026-07-29
 
 ### Changed

package/README.md

@@ -1,5 +1,7 @@
 # CoinPaprika MCP Server
 
+[![smithery badge](https://smithery.ai/badge/coinpaprika/coinpaprika)](https://smithery.ai/servers/coinpaprika/coinpaprika)
+
 A Model Context Protocol (MCP) server that provides on-demand access to CoinPaprika's cryptocurrency market data API. Built specifically for AI assistants like Claude to programmatically fetch real-time prices, tickers, exchange data, OHLCV candles, and more with zero configuration.
 
 ## TL;DR
@@ -15,16 +17,16 @@ coinpaprika-mcp
 npx @coinpaprika/mcp@latest
 ```
 
-CoinPaprika MCP connects Claude to live crypto market data for 8,000+ coins. No API key required for free-tier features. [Installation](#installation) | [Configuration](#claude-desktop-integration) | [API Reference](https://api.coinpaprika.com)
+CoinPaprika MCP connects Claude to live crypto market data for 12,000+ cryptocurrencies. The free tier needs no API key. [Installation](#installation) | [Configuration](#claude-desktop-integration) | [API Reference](https://api.coinpaprika.com)
 
-> **Prefer zero setup?** Use the hosted MCP server at [mcp.coinpaprika.com](https://mcp.coinpaprika.com) — no installation, no API key, same 30 tools. See [Hosted Alternative](#hosted-alternative-no-installation) for transport endpoints.
+> **Prefer zero setup?** Use the hosted MCP server at [mcp.coinpaprika.com](https://mcp.coinpaprika.com): no installation, no API key to start, 31 tools (the 30 here plus `submitFeedback`). See [Hosted server](#hosted-server-no-installation) for transport endpoints.
 
 ## What Can You Build?
 
 - **Market Dashboards**: Real-time market overview with global stats, top coins, and volume trends
-- **Coin Analysis Tools**: Deep-dive into any cryptocurrency — price, team, events, exchanges, and markets
+- **Coin Analysis Tools**: Deep-dive into any cryptocurrency: price, team, events, exchanges, and markets
 - **Price Trackers**: Track prices across multiple quote currencies with historical OHLCV data
-- **Exchange Comparisons**: Compare trading pairs and volumes across 200+ exchanges
+- **Exchange Comparisons**: Compare trading pairs and volumes across 350+ exchanges
 - **Portfolio Valuations**: Convert an amount between currencies ('0.5 BTC in USD') and track price changes over time
 - **Contract Lookup**: Find tokens by their smart contract address across multiple platforms
 
@@ -32,10 +34,10 @@ CoinPaprika MCP connects Claude to live crypto market data for 8,000+ coins. No
 
 ### Installing via Smithery
 
-To install CoinPaprika MCP for Claude Desktop automatically via [Smithery](https://smithery.ai/server/@coinpaprika/coinpaprika-mcp):
+To install CoinPaprika MCP for Claude Desktop automatically via [Smithery](https://smithery.ai/servers/coinpaprika/coinpaprika):
 
 ```bash
-npx -y @smithery/cli install @coinpaprika/coinpaprika-mcp --client claude
+npx -y smithery mcp add coinpaprika/coinpaprika
 ```
 
 ### Manual Installation
@@ -91,7 +93,7 @@ claude mcp add coinpaprika -- npx @coinpaprika/mcp@latest
 COINPAPRIKA_API_KEY=your-key claude mcp add coinpaprika -- npx @coinpaprika/mcp@latest
 ```
 
-### Hosted Alternative (No Installation)
+### Hosted server (no installation)
 
 If you prefer zero setup, point any MCP-compatible client directly at the hosted server at [mcp.coinpaprika.com](https://mcp.coinpaprika.com). The landing page provides setup instructions and documentation. The following transport endpoints are available:
 
@@ -101,7 +103,7 @@ If you prefer zero setup, point any MCP-compatible client directly at the hosted
 | SSE | `https://mcp.coinpaprika.com/sse` | Legacy SSE transport |
 | JSON-RPC | `https://mcp.coinpaprika.com/json-rpc` | Direct JSON-RPC |
 
-> **Note**: These are MCP protocol endpoints — they won't display anything in a browser. Visit [mcp.coinpaprika.com](https://mcp.coinpaprika.com) for the landing page.
+> **Note**: These are MCP protocol endpoints. They won't display anything in a browser. Visit [mcp.coinpaprika.com](https://mcp.coinpaprika.com) for the landing page.
 
 ```json
 {
@@ -128,7 +130,7 @@ If you prefer zero setup, point any MCP-compatible client directly at the hosted
 
 | Tool | Description | Required Parameters |
 |------|-------------|---------------------|
-| `getCoins` | List all coins (id, name, symbol, rank); no prices, use getTickers for prices | — |
+| `getCoins` | List all coins (id, name, symbol, rank); no prices, use getTickers for prices | none |
 | `getCoinById` | Coin project details (description, team, links); no price, use getTickersById | `coinId` |
 | `getCoinEvents` | Upcoming events for a coin | `coinId` |
 | `getCoinExchanges` | Exchanges listing a coin | `coinId` |
@@ -138,7 +140,7 @@ If you prefer zero setup, point any MCP-compatible client directly at the hosted
 
 | Tool | Description | Required Parameters |
 |------|-------------|---------------------|
-| `getTickers` | Current prices + market caps for top coins by market cap ('top 5 coins', market snapshot) | — |
+| `getTickers` | Current prices + market caps for top coins by market cap ('top 5 coins', market snapshot) | none |
 | `getTickersById` | Current price, market cap & 24h change of one coin ('BTC price', 'how much is ETH') | `coinId` |
 | `getCoinOHLCVLatest` | Latest full-day OHLC candle (not the live price) | `coinId` |
 | `getCoinOHLCVToday` | Today's in-progress OHLC candle | `coinId` |
@@ -148,7 +150,7 @@ If you prefer zero setup, point any MCP-compatible client directly at the hosted
 
 | Tool | Description | Required Parameters |
 |------|-------------|---------------------|
-| `getExchanges` | List all exchanges | — |
+| `getExchanges` | List all exchanges | none |
 | `getExchangeByID` | Exchange details | `exchangeId` |
 | `getExchangeMarkets` | Markets on a specific exchange | `exchangeId` |
 
@@ -156,7 +158,7 @@ If you prefer zero setup, point any MCP-compatible client directly at the hosted
 
 | Tool | Description | Required Parameters |
 |------|-------------|---------------------|
-| `getTags` | List all tags/categories | — |
+| `getTags` | List all tags/categories | none |
 | `getTagById` | Tag details | `tagId` |
 | `getPeopleById` | Person/team member details | `personId` |
 
@@ -164,7 +166,7 @@ If you prefer zero setup, point any MCP-compatible client directly at the hosted
 
 | Tool | Description | Required Parameters |
 |------|-------------|---------------------|
-| `getPlatforms` | List contract platforms | — |
+| `getPlatforms` | List contract platforms | none |
 | `getContracts` | Contracts on a platform | `platformId` |
 | `getTickerByContract` | Token price by contract address (on-chain/DeFi tokens) | `platformId`, `contractAddress` |
 
@@ -241,32 +243,32 @@ const resolved = await resolveId({ type: "coin", query: "cardano" });
 ## Sample Prompts for Claude
 
 - "What's the current price of Bitcoin and Ethereum? Show me 24h change."
-- "Give me a comprehensive analysis of Cardano — price, team, events, and top exchanges."
+- "Give me a comprehensive analysis of Cardano: price, team, events, and top exchanges."
 - "Compare the top 5 crypto exchanges by trading volume."
 - "Convert 10 ETH to USD and show the current exchange rate."
 - "Find all coins tagged as 'defi' and show their market caps."
 - "What exchanges list Solana and what trading pairs are available?"
 - "Show me the OHLCV data for Bitcoin today."
 - "Search for all coins related to 'layer-2' and rank them by market cap."
-- "Look up the team behind Ethereum — who are the key people?"
+- "Look up the team behind Ethereum. Who are the key people?"
 - "Get the ticker for USDT by its Ethereum contract address."
 
 ## Rate Limits & Performance
 
-- **Free Tier Limits**: 10,000 requests per day
+- **Free Tier Limits**: 20,000 calls per month, no API key needed. Paid plans start at $99/month for 400,000 calls: https://coinpaprika.com/api/pricing/
 - **Response Time**: 100-500ms for most endpoints
-- **Data Coverage**: 8,000+ coins, 200+ exchanges
+- **Data Coverage**: 12,000+ cryptocurrencies, 350+ exchanges
 - **Error Handling**: Structured errors with codes, suggestions, and retry guidance
-- **Rate Limit Info**: Every response includes rate limit metadata
+- **Quota Info**: Running this package yourself, every response carries a `meta.quota` block with the monthly free-tier allowance and the number of calls this server process has made since it started. That count is process-local, not your account balance. The hosted server at `mcp.coinpaprika.com` returns no `meta` block at all, so do not write client code that depends on one
 
 ## Troubleshooting
 
 **Common Issues:**
 
-- **Rate limiting**: If receiving `CP429_RATE_LIMIT` errors, wait for daily reset at midnight UTC
+- **Rate limiting**: If receiving `CP429_RATE_LIMIT` errors, back off and retry. The free-tier quota is monthly, not daily, so a sustained 429 means the monthly allowance is spent
 - **Invalid coin ID**: Coin IDs use `symbol-name` format (e.g., `btc-bitcoin`, not `bitcoin` or `BTC`). Use `search` or `resolveId` to find correct IDs
 - **Paid-tier errors**: `CP402_INSUFFICIENT_PLAN` or `CP403_FORBIDDEN` mean the endpoint requires a paid plan. Set `COINPAPRIKA_API_KEY` environment variable
-- **Timeout errors**: Large data requests may take longer — reduce the `limit` parameter
+- **Timeout errors**: Large data requests may take longer, so reduce the `limit` parameter
 - **Network errors**: Check network connectivity, the service requires internet access
 
 ## Development
@@ -296,10 +298,10 @@ This project is licensed under the MIT License - see the [LICENSE](LICENSE) file
 
 ## Additional Resources
 
-- [CoinPaprika API Documentation](https://api.coinpaprika.com)
+- [CoinPaprika API Documentation](https://docs.coinpaprika.com)
 - [API Pricing & Plans](https://coinpaprika.com/api/pricing/)
-- [Hosted MCP Server](https://mcp.coinpaprika.com) — Zero-setup alternative
-- [DexPaprika MCP](https://www.npmjs.com/package/dexpaprika-mcp) — DEX & DeFi data companion package
+- [Hosted MCP Server](https://mcp.coinpaprika.com), zero-setup option
+- [DexPaprika MCP](https://www.npmjs.com/package/dexpaprika-mcp), DEX and DeFi data companion package
 - [Model Context Protocol Specification](https://modelcontextprotocol.io)
-- [CoinPaprika](https://coinpaprika.com) — Comprehensive cryptocurrency market data
-- [DexPaprika](https://dexpaprika.com) — Onchain DEX analytics
+- [CoinPaprika](https://coinpaprika.com), comprehensive cryptocurrency market data
+- [DexPaprika](https://dexpaprika.com), onchain DEX analytics

package/dist/index.js

@@ -2,6 +2,7 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { createRequire } from 'module';
 import fetch from 'node-fetch';
+import { assertPathUnchanged } from './safe-path.js';
 import { z } from 'zod';
 
 // Server version, read from package.json so the banner, capabilities
@@ -41,7 +42,7 @@ const COIN_ID_REGEX = /^[a-z0-9]+-[a-z0-9-]+$/;
 const COIN_ID_DESCRIPTION =
   "Canonical CoinPaprika coin slug in 'symbol-name' format, e.g. 'btc-bitcoin', " +
   "'eth-ethereum', 'ada-cardano'. Do NOT pass ticker symbols ('BTC', 'AAVE') " +
-  "or guess the slug — it is not derivable from the symbol (e.g. AAVE resolves " +
+  "or guess the slug; it is not derivable from the symbol (e.g. AAVE resolves " +
   "to 'aave-new', which you could not guess). Call search or resolveId first to " +
   "resolve a symbol or name to its canonical id.";
 
@@ -93,18 +94,15 @@ function parseAPIError(status, statusText, endpoint) {
   }
 
   if (status === 429) {
-    const resetTime = new Date();
-    resetTime.setUTCHours(24, 0, 0, 0);
     return buildErrorResponse(
       ErrorCodes.CP429_RATE_LIMIT,
-      'Daily rate limit of 10,000 requests exceeded',
+      'Rate limit exceeded',
       true,
-      'Wait until rate limit resets or use cached data',
+      'Back off and retry. The free-tier quota is 20,000 calls per month, not a daily allowance, so a sustained 429 means the monthly allowance is spent. See https://coinpaprika.com/api/pricing/',
       undefined,
       {
-        limit: 10000,
-        reset_at: resetTime.toISOString(),
-        retry_after_seconds: Math.floor((resetTime.getTime() - Date.now()) / 1000)
+        free_tier_calls_per_month: 20000,
+        pricing_url: 'https://coinpaprika.com/api/pricing/'
       }
     );
   }
@@ -114,7 +112,7 @@ function parseAPIError(status, statusText, endpoint) {
       ErrorCodes.CP404_NOT_FOUND,
       'Resource not found',
       false,
-      'No resource with that id exists — it may be misspelled, retired, or for a different entity. Call search or resolveId to get the current canonical id, then retry.',
+      'No resource with that id exists. It may be misspelled, retired, or for a different entity. Call search or resolveId to get the current canonical id, then retry.',
       undefined,
       { endpoint }
     );
@@ -171,9 +169,13 @@ function validateCoinId(coinId) {
   return null;
 }
 
-// Rate limit tracking
+// Quota tracking. The CoinPaprika free tier is a MONTHLY allowance (20,000
+// calls), not a daily one. This counter only sees calls made by this process
+// since it started, so `remaining` is a local upper bound, not the account's
+// real balance. Use the keyInfo tool with a paid key for the authoritative
+// figure.
 let requestCount = 0;
-const RATE_LIMIT = 10000;
+const FREE_TIER_CALLS_PER_MONTH = 20000;
 
 // Build request headers (with optional API key)
 function buildHeaders() {
@@ -194,7 +196,9 @@ function clamp(n, min, max) {
 // Helper function to fetch data from CoinPaprika API with structured error handling
 async function fetchFromAPI(endpoint) {
   const startTime = Date.now();
-  const response = await fetch(`${API_BASE_URL}${endpoint}`, { headers: buildHeaders() });
+  const url = `${API_BASE_URL}${endpoint}`;
+  assertPathUnchanged(url); // before the key leaves the process
+  const response = await fetch(url, { headers: buildHeaders() });
 
   if (!response.ok) {
     const structuredError = parseAPIError(response.status, response.statusText, endpoint);
@@ -205,18 +209,14 @@ async function fetchFromAPI(endpoint) {
   requestCount++;
   const responseTime = Date.now() - startTime;
 
-  const resetTime = new Date();
-  resetTime.setUTCHours(24, 0, 0, 0);
-
   return {
     data,
     meta: {
-      rate_limit: {
-        limit: RATE_LIMIT,
-        remaining: RATE_LIMIT - requestCount,
-        used: requestCount,
-        percentage_used: Math.round((requestCount / RATE_LIMIT) * 10000) / 100,
-        reset_at: resetTime.toISOString()
+      quota: {
+        free_tier_calls_per_month: FREE_TIER_CALLS_PER_MONTH,
+        used_this_process: requestCount,
+        scope: 'this process since start, not the account balance',
+        pricing_url: 'https://coinpaprika.com/api/pricing/'
       },
       response_time_ms: responseTime,
       cached: false,
@@ -284,7 +284,7 @@ function buildCapabilitiesDocument() {
       name: "CoinPaprika MCP Server",
       version: SERVER_VERSION,
       description: "Real-time cryptocurrency prices, market caps, 24h changes and volumes for 12,000+ coins (Bitcoin, Ethereum, Solana, and more) and 350+ exchanges. Use for how much a crypto is worth, top coins by market cap, or live market data.",
-      documentation_url: "https://api.coinpaprika.com",
+      documentation_url: "https://docs.coinpaprika.com",
     },
     tools: [
       {
@@ -619,8 +619,10 @@ function buildCapabilitiesDocument() {
     },
 
     rate_limits: {
-      requests_per_day: 10000,
-      burst_limit: 100
+      free_tier_calls_per_month: 20000,
+      note: "Free tier allowance. Paid plans start at 400,000 calls per month; see https://coinpaprika.com/api/pricing/",
+      documentation_url: "https://docs.coinpaprika.com",
+      pricing_url: "https://coinpaprika.com/api/pricing/"
     },
 
     error_codes: {
@@ -628,9 +630,9 @@ function buildCapabilitiesDocument() {
       CP400_MISSING_REQUIRED: "Required parameter is missing",
       CP400_BAD_REQUEST: "Invalid request parameters",
       CP402_INSUFFICIENT_PLAN: "This endpoint requires a paid plan",
-      CP403_FORBIDDEN: "Access forbidden — check API key or plan",
+      CP403_FORBIDDEN: "Access forbidden. Check API key or plan",
       CP404_NOT_FOUND: "Resource not found. Use search to find correct IDs",
-      CP429_RATE_LIMIT: "Daily rate limit exceeded. Resets at midnight UTC",
+      CP429_RATE_LIMIT: "Rate limit exceeded. The free-tier quota is monthly, not daily",
       CP500_SERVER_ERROR: "Internal server error. Please try again later"
     },
 
@@ -718,14 +720,14 @@ function buildCapabilitiesDocument() {
       ],
       error_handling: [
         "Always validate coin ID format before API calls",
-        "Handle 402/403 errors gracefully — they indicate paid-plan requirements",
+        "Handle 402/403 errors gracefully; they indicate paid-plan requirements",
         "Retry with backoff for 429 rate limit errors",
         "Use resolveId to find correct IDs when 404 errors occur",
       ],
     },
 
     meta: {
-      documentation: "https://api.coinpaprika.com",
+      documentation: "https://docs.coinpaprika.com",
       pricing: "https://coinpaprika.com/api/pricing/",
       support: "https://github.com/coinpaprika/coinpaprika-mcp"
     }
@@ -743,7 +745,7 @@ const server = new McpServer({
 // returning the structured CP400_INVALID_COIN_ID guidance (matches the hosted
 // MCP). Wrapping server.tool centralizes this for every id-bearing tool
 // (coinId / baseCurrencyId / quoteCurrencyId) instead of repeating it in each
-// handler — so a ticker symbol like "BTC" gets actionable guidance to call
+// handler, so a ticker symbol like "BTC" gets actionable guidance to call
 // search/resolveId instead of a bare upstream 404.
 const _registerTool = server.tool.bind(server);
 server.tool = (...regArgs) => {
@@ -780,7 +782,7 @@ server.tool(
       api_key_configured: !!API_KEY,
       mode: API_KEY ? 'authenticated' : 'free-tier',
       paid_features: API_KEY
-        ? 'API key configured — paid-tier endpoints available'
+        ? 'API key configured, paid-tier endpoints available'
         : 'No API key configured. For Pro/Business features, set COINPAPRIKA_API_KEY environment variable. Get a key at https://coinpaprika.com/api/pricing/',
     };
     return formatMcpResponse(statusData);
@@ -1326,7 +1328,7 @@ server.tool(
   },
   async (params) => {
     const qs = new URLSearchParams();
-    // Allowlist the upstream-recognized mapping params only — never forward
+    // Allowlist the upstream-recognized mapping params only, never forward
     // MCP-only or unexpected fields, which the upstream rejects with a 400.
     for (const k of ['coinpaprika', 'coinmarketcap', 'coingecko', 'cryptocompare', 'isin', 'dti']) {
       const v = params[k];
@@ -1377,9 +1379,9 @@ async function main() {
     await server.connect(transport);
     console.error(`CoinPaprika MCP server v${SERVER_VERSION} is running...`);
     if (API_KEY) {
-      console.error('API key configured — paid-tier endpoints available.');
+      console.error('API key configured, paid-tier endpoints available.');
     } else {
-      console.error('No API key configured — running in free-tier mode. Set COINPAPRIKA_API_KEY for paid features.');
+      console.error('No API key configured, running in free-tier mode. Set COINPAPRIKA_API_KEY for paid features.');
     }
   } catch (error) {
     console.error('Failed to start server:', error);

package/dist/safe-path.js

@@ -0,0 +1,28 @@
+// Ids reach the upstream path through encodeURIComponent, which encodes "/", "?" and "#" but
+// leaves "." and "..". An id of ".." would make the request, with your API key on it, go to a
+// different path than the tool intended, because URL parsing resolves dot segments. And an id
+// of "../key/info" encodes to "..%2Fkey%2Finfo", which URL parsing leaves alone but a server
+// that decodes before routing might not. So refuse any URL whose path changes when parsed, and
+// any path segment that, decoded once, is "." or ".." or holds "/", "\" or "%". No real coin,
+// exchange, tag, person, platform or contract id contains any of these.
+export function assertPathUnchanged(url) {
+  const afterScheme = url.indexOf('://');
+  const pathStart = afterScheme === -1 ? -1 : url.indexOf('/', afterScheme + 3);
+  if (pathStart === -1) return;
+  const end = url.slice(pathStart).search(/[?#]/);
+  const rawPath = end === -1 ? url.slice(pathStart) : url.slice(pathStart, pathStart + end);
+  if (new URL(url).pathname !== rawPath) {
+    throw new Error('Invalid identifier: an id may not be "." or "..".');
+  }
+  for (const seg of rawPath.split('/').slice(1)) {
+    let decoded;
+    try {
+      decoded = decodeURIComponent(seg);
+    } catch {
+      throw new Error('Invalid identifier.');
+    }
+    if (decoded === '.' || decoded === '..' || /[\\/%]/.test(decoded)) {
+      throw new Error('Invalid identifier.');
+    }
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@coinpaprika/mcp",
-  "version": "1.3.3",
-  "description": "A Model Context Protocol server for CoinPaprika cryptocurrency market data \u2014 prices, tickers, exchanges, and more",
+  "version": "1.4.1",
+  "description": "A Model Context Protocol server for CoinPaprika cryptocurrency market data: prices, tickers, exchanges, and more",
   "main": "dist/index.js",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
     "build": "mkdir -p dist && cp -r src/* dist/ && chmod +x dist/bin.js",
     "prepublishOnly": "npm run build",
     "start": "node src/index.js",
-    "test": "node test/smoke.js"
+    "test": "node test/path_safety.js && node test/smoke.js"
   },
   "keywords": [
     "mcp",