@mcptoolshop/ai-loadout 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 1.0.1 — 2026-03-06
+
+- Add `hint` field to `ValidationIssue` (Tier 1 error shape compliance)
+- Add hints to key validation issues (MISSING_ID, MISSING_PATH, EMPTY_KEYWORDS)
+- Add SECURITY.md with threat model
+- Expand README security section with threat model table
+- Add logo
+- Include SECURITY.md and logo.png in npm package
+
 ## 1.0.0 — 2026-03-06
 
 Initial release.

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="https://raw.githubusercontent.com/mcp-tool-shop-org/brand/main/logos/ai-loadout/readme.png" width="400" alt="ai-loadout">
+  <img src="logo.png" width="400" alt="ai-loadout">
 </p>
 
 <p align="center">
@@ -176,6 +176,17 @@ import type {
 
 This package is a pure data library. It does not access the filesystem, make network requests, or collect telemetry. All I/O is the consumer's responsibility.
 
+### Threat Model
+
+| Threat | Mitigation |
+|--------|------------|
+| Malformed frontmatter input | `parseFrontmatter()` returns `null` on invalid input — no exceptions, no eval |
+| Prototype pollution | Hand-rolled parser uses plain object literals, no `JSON.parse` of untrusted nested structures |
+| Index with bad data | `validateIndex()` catches structural issues before they propagate |
+| Regex DoS | No user-supplied regex — patterns are matched as plain string lookups |
+
+See [SECURITY.md](SECURITY.md) for the full security policy.
+
 ---
 
 Built by [MCP Tool Shop](https://mcp-tool-shop.github.io/)

package/SECURITY.md

@@ -0,0 +1,35 @@
+# Security Policy
+
+## Attack Surface
+
+`@mcptoolshop/ai-loadout` is a **pure data library**. It has:
+
+- **No filesystem access** — does not read or write files
+- **No network access** — makes no HTTP requests, opens no sockets
+- **No code execution** — no `eval`, `Function()`, or dynamic imports
+- **No telemetry** — collects and transmits nothing
+- **No native dependencies** — pure TypeScript, zero production deps
+
+All I/O is the consumer's responsibility. This package only transforms data structures in memory.
+
+## Input Validation
+
+The `parseFrontmatter()` function processes untrusted text input. It uses simple string splitting — no YAML parser, no regex-based evaluation, no prototype pollution vectors.
+
+The `validateIndex()` function checks structural integrity of index objects. It does not execute or interpret any field values.
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| 1.x     | Yes       |
+
+## Reporting a Vulnerability
+
+If you discover a security issue, please email **64996768+mcp-tool-shop@users.noreply.github.com** with:
+
+- Description of the vulnerability
+- Steps to reproduce
+- Impact assessment
+
+We will respond within 7 days and aim to release a fix within 14 days for confirmed issues.

package/dist/types.d.ts

@@ -45,6 +45,7 @@ export interface ValidationIssue {
     severity: IssueSeverity;
     code: string;
     message: string;
+    hint?: string;
     entryId?: string;
 }
 export declare const DEFAULT_TRIGGERS: Triggers;

package/dist/validate.js

@@ -51,6 +51,7 @@ export function validateIndex(index) {
                 severity: "error",
                 code: "MISSING_ID",
                 message: "Entry is missing an id field",
+                hint: "Every entry needs a unique kebab-case id",
             });
             continue;
         }
@@ -79,6 +80,7 @@ export function validateIndex(index) {
                 severity: "error",
                 code: "MISSING_PATH",
                 message: `Entry "${entry.id}" has no path`,
+                hint: "Set path to the relative file location (e.g. .claude/rules/my-rule.md)",
                 entryId: entry.id,
             });
         }
@@ -114,6 +116,7 @@ export function validateIndex(index) {
                 severity: "error",
                 code: "EMPTY_KEYWORDS",
                 message: `Domain entry "${entry.id}" has no keywords — cannot be routed`,
+                hint: "Add keywords to frontmatter so the matcher can find this entry",
                 entryId: entry.id,
             });
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcptoolshop/ai-loadout",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Context-aware knowledge router for AI agents. Dispatch table, frontmatter spec, keyword matcher, token estimator.",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,9 @@
     "dist",
     "README.md",
     "CHANGELOG.md",
-    "LICENSE"
+    "LICENSE",
+    "SECURITY.md",
+    "logo.png"
   ],
   "keywords": [
     "ai",