@nekzus/mcp-server 1.16.2 → 1.18.0

package/dist/index.js

@@ -699,13 +699,19 @@ export async function handleNpmDeps(args) {
                         version: depVersion,
                     }));
                 };
+                const actualVersion = rawData.version || version; // Use version from response if available
+                const finalPackageName = `${name}@${actualVersion}`;
+                // Fetch transitive dependencies from deps.dev to provide deep topological insights
+                const transitiveGraphRaw = await fetchTransitiveDependenciesFromDepsDev(name, actualVersion);
+                // Erase root package from the graph to avoid self-counting if returned
+                const transitiveGraph = transitiveGraphRaw.filter((dep) => dep.name !== name);
                 const depData = {
                     dependencies: mapDeps(rawData.dependencies),
                     devDependencies: mapDeps(rawData.devDependencies),
                     peerDependencies: mapDeps(rawData.peerDependencies),
+                    transitiveCount: transitiveGraph.length,
+                    transitiveGraph: transitiveGraph,
                 };
-                const actualVersion = rawData.version || version; // Use version from response if available
-                const finalPackageName = `${name}@${actualVersion}`;
                 // Store with the actual resolved package name if 'latest' was used
                 cacheSet(cacheKey, { depData, packageNameForCache: finalPackageName }, CACHE_TTL_MEDIUM);
                 return {
@@ -713,7 +719,7 @@ export async function handleNpmDeps(args) {
                     status: 'success',
                     error: null,
                     data: depData,
-                    message: `Dependencies for ${finalPackageName}`,
+                    message: `Dependencies for ${finalPackageName} (Direct: ${depData.dependencies.length}, Transitive: ${depData.transitiveCount})`,
                 };
             }
             catch (error) {
@@ -1009,23 +1015,32 @@ export async function handleNpmSize(args) {
         };
     }
 }
-// Helper to detect dependencies
-async function getPackageDependencies(pkgName, version) {
+// Helper to fetch full transitive dependency graph from deps.dev
+async function fetchTransitiveDependenciesFromDepsDev(pkgName, version) {
     try {
-        const response = await fetch(`${NPM_REGISTRY_URL}/${pkgName}/${version}`, {
+        const encodedName = encodeURIComponent(pkgName);
+        const encodedVersion = encodeURIComponent(version);
+        const url = `https://api.deps.dev/v3/systems/npm/packages/${encodedName}/versions/${encodedVersion}:dependencies`;
+        const response = await fetch(url, {
             headers: { Accept: 'application/json', 'User-Agent': 'NPM-Sentinel-MCP' },
         });
-        if (!response.ok)
-            return { dependencies: {}, devDependencies: {} };
+        if (!response.ok) {
+            console.warn(`deps.dev API returned ${response.status} for ${pkgName}@${version}`);
+            return [];
+        }
         const data = (await response.json());
-        return {
-            dependencies: data.dependencies || {},
-            devDependencies: data.devDependencies || {},
-        };
+        if (!data.nodes || !Array.isArray(data.nodes))
+            return [];
+        return data.nodes
+            .filter((node) => node.versionKey?.name)
+            .map((node) => ({
+            name: node.versionKey.name,
+            version: node.versionKey.version,
+        }));
     }
     catch (error) {
-        console.error(`Error fetching dependencies for ${pkgName}:`, error);
-        return { dependencies: {}, devDependencies: {} };
+        console.error(`Error fetching transitive dependencies from deps.dev for ${pkgName}:`, error);
+        return [];
     }
 }
 // Helper to resolve 'latest' tag to actual version number
@@ -1107,31 +1122,19 @@ export async function handleNpmVulnerabilities(args) {
                 });
             }
         };
-        // Recursive dependency fetcher
-        const seenPackages = new Set();
-        const depthLimit = 2; // Default depth limit for transitive scanning
-        const processPackage = async (name, version, currentDepth) => {
-            const pkgKey = `${name}@${version || 'latest'}`;
-            if (seenPackages.has(pkgKey))
-                return;
-            seenPackages.add(pkgKey);
-            // Add to vulnerability query
-            // For the main package (depth 0), isDependency is false. For others, true.
-            addToQuery(name, version || 'latest', currentDepth > 0);
-            if (currentDepth >= depthLimit)
-                return;
-            // If version is 'latest' or undefined, we settled it in addToQuery, but for fetching deps we need a concrete version
-            // If we don't have one, we might need to resolve it again or let getPackageDependencies handle 'latest'
-            // getPackageDependencies handles 'latest' by default.
-            const { dependencies } = await getPackageDependencies(name, version || 'latest');
-            // Process children
-            const children = Object.entries(dependencies);
-            await Promise.all(children.map(async ([depName, depVersion]) => {
-                const cleanVersion = depVersion.replace(/[\^~]/g, '');
-                if (/^\d+\.\d+\.\d+/.test(cleanVersion)) {
-                    await processPackage(depName, cleanVersion, currentDepth + 1);
-                }
-            }));
+        const processPackage = async (name, version) => {
+            const safeVersion = version || 'latest';
+            // Always add the root package (depth 0 logic)
+            addToQuery(name, safeVersion, false);
+            // Try to get all transitive dependencies in a single call to deps.dev
+            // They require a concrete version (or we pass exactly what we have)
+            const allDeps = await fetchTransitiveDependenciesFromDepsDev(name, safeVersion);
+            for (const dep of allDeps) {
+                // Avoid adding the root package itself again, which is included in the graph
+                if (dep.name === name)
+                    continue;
+                addToQuery(dep.name, dep.version, true);
+            }
         };
         const validationErrors = [];
         const validPackagesToProcess = packagesToProcess.filter((pkgInput) => {
@@ -1203,14 +1206,12 @@ export async function handleNpmVulnerabilities(args) {
                     version = resolved;
                 }
             }
-            // Start recursive processing
-            await processPackage(name, version, 0);
+            // Start fetching dependencies with deps.dev
+            await processPackage(name, version);
             // Ecosystem Check: Scan associated packages that share the same version
             if (ECOSYSTEM_MAP[name]) {
                 for (const associatedPkg of ECOSYSTEM_MAP[name]) {
-                    // We scan these as "depth 0" (explicitly requested by ecosystem logic)
-                    // so they are checked fully.
-                    await processPackage(associatedPkg, version, 0);
+                    await processPackage(associatedPkg, version);
                 }
             }
         }));
@@ -2197,7 +2198,7 @@ export async function handleNpmPackageReadme(args) {
         }
         const processedResults = await Promise.all(packagesToProcess.map(async (pkgInput) => {
             let name = '';
-            let versionTag = undefined; // Explicitly undefined if not specified
+            let versionTag; // Explicitly undefined if not specified
             if (typeof pkgInput === 'string') {
                 const atIdx = pkgInput.lastIndexOf('@');
                 if (atIdx > 0) {
@@ -2720,7 +2721,7 @@ export async function handleNpmRepoStats(args) {
                     cacheSet(cacheKey, resultNoRepo, CACHE_TTL_LONG);
                     return resultNoRepo;
                 }
-                const githubMatch = repoUrl.match(/github\.com[:\/]([^\/]+)\/([^\/.]+)/);
+                const githubMatch = repoUrl.match(/github\.com[:/]([^/]+)\/([^/.]+)/);
                 if (!githubMatch) {
                     const resultNotGitHub = {
                         packageInput: pkgInput,
@@ -3021,7 +3022,7 @@ export async function handleNpmChangelogAnalysis(args) {
         }
         const processedResults = await Promise.all(packagesToProcess.map(async (pkgInput) => {
             let name = '';
-            let versionQueried = undefined;
+            let versionQueried;
             if (typeof pkgInput === 'string') {
                 const atIdx = pkgInput.lastIndexOf('@');
                 if (atIdx > 0) {
@@ -3118,7 +3119,7 @@ export async function handleNpmChangelogAnalysis(args) {
                     cacheSet(cacheKey, resultNoRepo, CACHE_TTL_MEDIUM);
                     return resultNoRepo;
                 }
-                const githubMatch = repositoryUrl.match(/github\.com[:\/]([^\/]+)\/([^\/.]+)/);
+                const githubMatch = repositoryUrl.match(/github\.com[:/]([^/]+)\/([^/.]+)/);
                 if (!githubMatch) {
                     const resultNotGitHub = {
                         packageInput: pkgInput,
@@ -3257,7 +3258,7 @@ export async function handleNpmAlternatives(args) {
         }
         const processedResults = await Promise.all(packagesToProcess.map(async (pkgInput) => {
             let originalPackageName = '';
-            let versionQueried = undefined;
+            let versionQueried;
             if (typeof pkgInput === 'string') {
                 const atIdx = pkgInput.lastIndexOf('@');
                 if (atIdx > 0) {
@@ -3432,7 +3433,7 @@ export const configSchema = z.object({
     NPM_REGISTRY_URL: z.string().optional().describe('URL of the NPM registry to use'),
 });
 // Create server function for Smithery CLI
-export default function createServer({ config, }) {
+export default function createServer({ config }) {
     // Apply config overrides
     if (config.NPM_REGISTRY_URL) {
         NPM_REGISTRY_URL = config.NPM_REGISTRY_URL.replace(/\/$/, '');