@mcp-release/cli 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +87 -0
- package/dist/index.js +49126 -0
- package/package.json +45 -0
package/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 Stepan Belorybkin
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/README.md
ADDED
|
@@ -0,0 +1,87 @@
|
|
|
1
|
+
# @mcp-release/cli
|
|
2
|
+
|
|
3
|
+
Release validation CLI for MCP servers. Verifies the protocol handshake, discovers tools, validates their schemas, and checks network configuration. Tools are never invoked.
|
|
4
|
+
|
|
5
|
+
## Install
|
|
6
|
+
|
|
7
|
+
```bash
|
|
8
|
+
npm install -g @mcp-release/cli
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
Or run without installing:
|
|
12
|
+
|
|
13
|
+
```bash
|
|
14
|
+
npx @mcp-release/cli check https://your-mcp-server.example.com/mcp
|
|
15
|
+
```
|
|
16
|
+
|
|
17
|
+
Requires Node.js >= 22.13.0.
|
|
18
|
+
|
|
19
|
+
## Usage
|
|
20
|
+
|
|
21
|
+
```bash
|
|
22
|
+
# Public endpoint
|
|
23
|
+
mcp-release check https://your-mcp-server.example.com/mcp
|
|
24
|
+
|
|
25
|
+
# JSON output
|
|
26
|
+
mcp-release check https://example.com/mcp --json
|
|
27
|
+
|
|
28
|
+
# Markdown output
|
|
29
|
+
mcp-release check https://example.com/mcp --markdown
|
|
30
|
+
|
|
31
|
+
# Write report to file
|
|
32
|
+
mcp-release check https://example.com/mcp --json --out report.json
|
|
33
|
+
|
|
34
|
+
# Bearer token from environment variable (recommended for secrets)
|
|
35
|
+
MCP_TOKEN=your-token mcp-release check https://staging.example.com/mcp --bearer-token-env MCP_TOKEN
|
|
36
|
+
|
|
37
|
+
# Literal header (for non-secret values only)
|
|
38
|
+
mcp-release check https://staging.example.com/mcp --header "X-Tenant-Id: acme"
|
|
39
|
+
|
|
40
|
+
# Header value from environment variable
|
|
41
|
+
MY_KEY=secret mcp-release check https://staging.example.com/mcp --header-env "X-API-Key=MY_KEY"
|
|
42
|
+
|
|
43
|
+
# Localhost or private network endpoint
|
|
44
|
+
mcp-release check http://localhost:4000/mcp --allow-http
|
|
45
|
+
|
|
46
|
+
# Exit 4 on WARNING (e.g., AUTH_REQUIRED)
|
|
47
|
+
MCP_TOKEN=your-token mcp-release check https://staging.example.com/mcp \
|
|
48
|
+
--bearer-token-env MCP_TOKEN --fail-on-warning
|
|
49
|
+
```
|
|
50
|
+
|
|
51
|
+
## Options
|
|
52
|
+
|
|
53
|
+
| Option | Description |
|
|
54
|
+
|---|---|
|
|
55
|
+
| `--header "Name: value"` | Add a request header. Repeatable. Use for non-secret values only. |
|
|
56
|
+
| `--header-env "Name=VAR"` | Read a header value from an env var. Repeatable. |
|
|
57
|
+
| `--bearer-token-env VAR` | Read a bearer token from an env var; sends `Authorization: Bearer <token>`. |
|
|
58
|
+
| `--timeout-ms <ms>` | Request timeout in milliseconds (default: 10000). |
|
|
59
|
+
| `--max-redirects <n>` | Maximum redirects to follow (default: 3). |
|
|
60
|
+
| `--allow-http` | Allow HTTP connections for localhost/development. |
|
|
61
|
+
| `--json` | Print JSON report to stdout. |
|
|
62
|
+
| `--markdown` | Print Markdown report to stdout. |
|
|
63
|
+
| `--out <path>` | Write report to file (JSON by default; Markdown if `--markdown`). |
|
|
64
|
+
| `--fail-on-warning` | Exit 4 when overall status is WARNING. |
|
|
65
|
+
|
|
66
|
+
## Exit codes
|
|
67
|
+
|
|
68
|
+
| Code | Meaning |
|
|
69
|
+
|---|---|
|
|
70
|
+
| `0` | PASS |
|
|
71
|
+
| `1` | FAIL (validation found a blocking issue) |
|
|
72
|
+
| `2` | Invalid CLI usage (bad arguments, missing env var) |
|
|
73
|
+
| `3` | Transport error, timeout, or unexpected runtime error |
|
|
74
|
+
| `4` | WARNING and `--fail-on-warning` was set |
|
|
75
|
+
|
|
76
|
+
## What is checked
|
|
77
|
+
|
|
78
|
+
- MCP initialization handshake and protocol version negotiation
|
|
79
|
+
- Tool names, descriptions, and `inputSchema` (valid JSON Schema)
|
|
80
|
+
- HTTPS enforcement and SSRF protection (DNS pinning, private IP blocking)
|
|
81
|
+
- Redirect chain validation (up to 3 hops by default)
|
|
82
|
+
|
|
83
|
+
Tools are never invoked. Credentials are never stored.
|
|
84
|
+
|
|
85
|
+
## Repository
|
|
86
|
+
|
|
87
|
+
https://github.com/daranium2020/mcp-release
|