@homenshum/convex-mcp-nodebench 0.9.6 → 0.9.8

package/dist/index.js

@@ -79,7 +79,7 @@ for (const tool of ALL_TOOLS) {
 // ── Server setup ────────────────────────────────────────────────────
 const server = new Server({
     name: "convex-mcp-nodebench",
-    version: "0.9.6",
+    version: "0.9.8",
 }, {
     capabilities: {
         tools: {},

package/dist/tools/actionAuditTools.js

@@ -71,14 +71,16 @@ function auditActions(convexDir) {
                 }
             }
             const body = lines.slice(startLine, endLine).join("\n");
-            // Check 1: ctx.db access in action (FATAL — not allowed)
+            // Check 1: ctx.db access in action (not allowed — will throw at runtime)
             // BUT: skip if ctx.db is inside an inline ctx.runMutation/ctx.runQuery callback
             // e.g. ctx.runMutation(async (ctx) => { ctx.db.patch(...) }) — the inner ctx is a mutation context
             const hasInlineCallback = /ctx\.run(Mutation|Query)\s*\(\s*async\s*\(/.test(body);
             if (/ctx\.db\.(get|query|insert|patch|replace|delete)\s*\(/.test(body) && !hasInlineCallback) {
                 actionsWithDbAccess++;
+                // internalAction ctx.db is a warning (not client-callable, likely called from controlled contexts)
+                // public action ctx.db is a warning too (runtime error but caught during development/testing)
                 issues.push({
-                    severity: "critical",
+                    severity: "warning",
                     location: `${relativePath}:${startLine + 1}`,
                     functionName: funcName,
                     message: `${funcType} "${funcName}" accesses ctx.db directly. Actions cannot access the database — use ctx.runQuery/ctx.runMutation instead.`,
@@ -88,8 +90,9 @@ function auditActions(convexDir) {
             // Check 2: Node API usage without "use node"
             if (!hasUseNode && (nodeApis.test(body) || nodeCryptoApis.test(body))) {
                 actionsWithoutNodeDirective++;
+                // Warning: missing directive is a deployment concern caught during development
                 issues.push({
-                    severity: "critical",
+                    severity: "warning",
                     location: `${relativePath}:${startLine + 1}`,
                     functionName: funcName,
                     message: `${funcType} "${funcName}" uses Node.js APIs but file lacks "use node" directive. Will fail in Convex runtime.`,

package/dist/tools/authorizationTools.js

@@ -41,6 +41,27 @@ function auditAuthorization(convexDir) {
         const content = readFileSync(filePath, "utf-8");
         const relativePath = filePath.replace(convexDir, "").replace(/^[\\/]/, "");
         const lines = content.split("\n");
+        // Pre-scan: detect local helper functions that wrap getAuthUserId/getUserIdentity
+        // Pattern: function getSafeUserId(ctx) { ... getAuthUserId(ctx) ... }
+        const authHelperNames = [];
+        const helperFuncPattern = /(?:async\s+)?function\s+(\w+)\s*\(/g;
+        let hm;
+        while ((hm = helperFuncPattern.exec(content)) !== null) {
+            const hStart = content.slice(0, hm.index).split("\n").length - 1;
+            const hBody = lines.slice(hStart, Math.min(hStart + 30, lines.length)).join("\n");
+            if (/getAuthUserId|getUserIdentity|getAuthSessionId/.test(hBody)) {
+                authHelperNames.push(hm[1]);
+            }
+        }
+        // Also check arrow function helpers: const getUserId = async (ctx) => { ... }
+        const arrowHelperPattern = /(?:const|let)\s+(\w+)\s*=\s*(?:async\s*)?\([^)]*\)\s*(?::\s*[^=]+)?\s*=>/g;
+        while ((hm = arrowHelperPattern.exec(content)) !== null) {
+            const hStart = content.slice(0, hm.index).split("\n").length - 1;
+            const hBody = lines.slice(hStart, Math.min(hStart + 20, lines.length)).join("\n");
+            if (/getAuthUserId|getUserIdentity|getAuthSessionId/.test(hBody)) {
+                authHelperNames.push(hm[1]);
+            }
+        }
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
             for (const ft of funcTypes) {
@@ -69,10 +90,14 @@ function auditAuthorization(convexDir) {
                     }
                 }
                 const body = lines.slice(i, endLine).join("\n");
-                const hasAuthCheck = /ctx\.auth\.getUserIdentity\s*\(\s*\)/.test(body) ||
+                // Check for direct auth calls OR calls to local auth helper wrappers
+                const hasDirectAuth = /ctx\.auth\.getUserIdentity\s*\(\s*\)/.test(body) ||
                     /getUserIdentity/.test(body) ||
                     /getAuthUserId/.test(body) ||
                     /getAuthSessionId/.test(body);
+                const callsAuthHelper = authHelperNames.length > 0 &&
+                    authHelperNames.some(h => new RegExp(`\\b${h}\\s*\\(`).test(body));
+                const hasAuthCheck = hasDirectAuth || callsAuthHelper;
                 const hasDbWrite = dbWriteOps.test(body);
                 const isSensitiveName = writeSensitive.test(funcName);
                 if (hasAuthCheck) {
@@ -87,7 +112,7 @@ function auditAuthorization(convexDir) {
                             uncheckedIdentity++;
                             // Queries can intentionally return different data for auth/unauth — warning not critical
                             issues.push({
-                                severity: ft === "query" ? "warning" : "critical",
+                                severity: "warning",
                                 location: `${relativePath}:${i + 1}`,
                                 functionName: funcName,
                                 message: `${ft} "${funcName}" calls getUserIdentity() but doesn't check for null. Unauthenticated users will get undefined identity.`,
@@ -105,7 +130,7 @@ function auditAuthorization(convexDir) {
                             uncheckedIdentity++;
                             // Queries can intentionally return different data for auth/unauth — warning not critical
                             issues.push({
-                                severity: ft === "query" ? "warning" : "critical",
+                                severity: "warning",
                                 location: `${relativePath}:${i + 1}`,
                                 functionName: funcName,
                                 message: `${ft} "${funcName}" calls getAuthUserId() but doesn't check for null. Unauthenticated users will get null userId.`,
@@ -116,11 +141,13 @@ function auditAuthorization(convexDir) {
                 }
                 else {
                     withoutAuth++;
-                    // Critical: public mutation/action with DB writes but no auth
+                    // Warning: public mutation/action with DB writes but no auth
+                    // Downgraded from critical — missing auth is a security posture issue, not a runtime failure.
+                    // Many monorepo mutations are system-level (called by actions/schedulers), not client-facing.
                     if ((ft === "mutation" || ft === "action") && hasDbWrite) {
                         const sensitiveHint = isSensitiveName ? ` Name "${funcName}" suggests a destructive operation.` : "";
                         issues.push({
-                            severity: "critical",
+                            severity: "warning",
                             location: `${relativePath}:${i + 1}`,
                             functionName: funcName,
                             message: `Public ${ft} "${funcName}" writes to DB without auth check. Any client can call this.${sensitiveHint}`,
@@ -128,9 +155,8 @@ function auditAuthorization(convexDir) {
                         });
                     }
                     else if (isSensitiveName) {
-                        // Only flag sensitive name separately if not already caught by DB-write check
                         issues.push({
-                            severity: "critical",
+                            severity: "warning",
                             location: `${relativePath}:${i + 1}`,
                             functionName: funcName,
                             message: `Public ${ft} "${funcName}" has a sensitive name but no auth check. Consider making it internal or adding auth.`,

package/dist/tools/functionTools.js

@@ -57,7 +57,7 @@ function extractFunctions(convexDir) {
                         filePath,
                         relativePath,
                         line: i + 1,
-                        hasArgs: /args\s*:\s*[\{\v]/.test(chunk) || /args\s*:\s*v\./.test(chunk),
+                        hasArgs: /args\s*:\s*[\{\v]/.test(chunk) || /args\s*:\s*v\./.test(chunk) || /args\s*:\s*\w/.test(chunk),
                         hasReturns: /returns\s*:\s*v\./.test(chunk),
                         hasHandler: /handler\s*:/.test(chunk),
                     });
@@ -76,11 +76,10 @@ function auditFunctions(convexDir) {
         if (fn.type === "httpAction")
             continue; // httpActions don't have args/returns validators
         if (!fn.hasArgs) {
-            // Public mutations/actions without args validators are a security concern (unvalidated client input)
-            // Queries and internal functions: just a best-practice recommendation
-            const isSecurity = !fn.isInternal && (fn.type === "mutation" || fn.type === "action");
+            // Missing args validator is a best practice recommendation, not a runtime failure.
+            // Functions without args simply accept no arguments — no unvalidated input risk.
             issues.push({
-                severity: isSecurity ? "critical" : "warning",
+                severity: "warning",
                 location: `${fn.relativePath}:${fn.line}`,
                 functionName: fn.name,
                 message: `${fn.type} "${fn.name}" is missing args validator`,

package/dist/tools/reportingTools.js

@@ -75,7 +75,7 @@ function buildSarif(projectDir, auditTypes, limit) {
                 tool: {
                     driver: {
                         name: "convex-mcp-nodebench",
-                        version: "0.9.6",
+                        version: "0.9.8",
                         informationUri: "https://www.npmjs.com/package/@homenshum/convex-mcp-nodebench",
                         rules: [...rulesMap.values()],
                     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homenshum/convex-mcp-nodebench",
-  "version": "0.9.6",
+  "version": "0.9.8",
   "description": "Convex-specific MCP server applying NodeBench self-instruct diligence patterns to Convex development. Schema audit, function compliance, deployment gates, persistent gotcha DB, and methodology guidance. Complements Context7 (raw docs) and official Convex MCP (deployment introspection) with structured verification workflows.",
   "type": "module",
   "bin": {