@parasraju/plumber-mcp 1.0.0 → 1.0.1

package/README.md

@@ -107,3 +107,13 @@ Tool inputs are deliberately small so they cost few tokens:
 
 - CLI: [plumber-linter](https://www.npmjs.com/package/plumber-linter)
 - Repository: [github.com/parasraju/plumber](https://github.com/parasraju/plumber)
+- Model Context Protocol: [modelcontextprotocol.io](https://modelcontextprotocol.io)
+- MCP TypeScript SDK: [github.com/modelcontextprotocol/typescript-sdk](https://github.com/modelcontextprotocol/typescript-sdk)
+
+## Changelog
+
+## 1.0.1
+- Fix false-positive test path matching that skipped secrets in files containing "test" or "spec" substrings (e.g. `latest.js`, `inspector.js`).
+- Fix directory scan skipping target path when root directory name matches skip list or begins with a dot (e.g. `dist`, `.hidden`).
+- Fix misleading 100/A score when target contains zero scannable files by reporting unverified status.
+- Fix MCP initialize handshake reporting static version by reading dynamically from `package.json`.

package/bin/plumber-mcp.js

@@ -21,9 +21,11 @@ const {
   ErrorCode,
   McpError
 } = require('@modelcontextprotocol/sdk/types.js');
-const { RULES, scanLocalDirectory, scanText } = require('../src/engine.js');
+const { RULES, SCANNABLE_EXTS, scanLocalDirectory, scanText } = require('../src/engine.js');
 
-const SERVER_INFO = { name: 'plumber-mcp', version: '1.0.0' };
+// v1.0.1 fix: read the version from package.json so serverInfo never drifts.
+// Repro (v1.0.0): initialize -> serverInfo.version was hardcoded to "1.0.0".
+const SERVER_INFO = { name: 'plumber-mcp', version: require('../package.json').version };
 
 const TOOLS = [
   {
@@ -64,10 +66,17 @@ const TOOLS = [
 function formatReport(report) {
   const header = [
     `Plumber Health Report for ${report.repo_name}`,
-    `Score: ${report.score}/100 (Grade ${report.grade})`,
+    report.total_files === 0 ? 'Score: n/a' : `Score: ${report.score}/100 (Grade ${report.grade})`,
     `Files: ${report.total_files} | Issues: ${report.issues.length}`
   ].join('\n');
 
+  // v1.0.1 fix: do not report "No issues found." when nothing was scanned.
+  // Repro (v1.0.0): plumber_scan { target: ".github/workflows/ci.yml" } (or a
+  //   Dockerfile, or an empty dir) -> "Score: 100/100 (Grade A) ... No issues found."
+  if (report.total_files === 0) {
+    return `${header}\n\nNo scannable files found, so nothing was checked. Supported: ${SCANNABLE_EXTS.join(' ')} and .env* files.`;
+  }
+
   if (report.issues.length === 0) {
     return `${header}\n\nNo issues found.`;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parasraju/plumber-mcp",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Plumber as an MCP server — let your AI coding agent scan repos for leaked secrets, dead code, and AI slop, with fixes in plain English.",
   "main": "src/engine.js",
   "bin": {

package/src/engine.js

@@ -53,8 +53,10 @@ function scoreFor(issueCount) {
   return Math.max(0, 100 - (issueCount * 4.2));
 }
 
+const SCANNABLE_EXTS = ['.py', '.js', '.jsx', '.ts', '.tsx', '.html', '.htm', '.css', '.scss', '.env'];
+
 function scanLocalDirectory(dirPath) {
-  const scannableExts = new Set(['.py', '.js', '.jsx', '.ts', '.tsx', '.html', '.htm', '.css', '.scss', '.env']);
+  const scannableExts = new Set(SCANNABLE_EXTS);
   const skipDirs = new Set(['.git', 'node_modules', 'dist', 'build', '.next', '.nuxt', 'vendor', '.venv', 'venv', '__pycache__']);
 
   const issues = [];
@@ -89,7 +91,11 @@ function scanLocalDirectory(dirPath) {
 
     if (stat.isDirectory()) {
       const base = path.basename(current);
-      if (skipDirs.has(base) || (base.startsWith('.') && base !== '.')) return;
+      // v1.0.1 fix: the skip list applies to subdirectories only, never to the
+      // directory the user asked to scan.
+      // Repro (v1.0.0): plumber_scan { target: "proj/dist" } or { target: "~/.dotfiles" }
+      //   with an AKIA key inside -> "Files: 0 | Issues: 0 ... No issues found."
+      if (current !== dirPath && (skipDirs.has(base) || base.startsWith('.'))) return;
       const entries = fs.readdirSync(current);
       for (const entry of entries) {
         walk(path.join(current, entry));
@@ -117,7 +123,7 @@ function scanText(text, filename) {
   if (typeof text !== 'string') {
     throw new TypeError('text must be a string');
   }
-  const name = filename && typeof filename === 'string' ? path.basename(filename) : 'snippet.js';
+  const name = filename && typeof filename === 'string' ? filename.replace(/\\/g, '/') : 'snippet.js';
   const ext = path.extname(name).toLowerCase();
   const content = text.replace(/\r\n?/g, '\n');
   const lines = content.split('\n');
@@ -135,11 +141,23 @@ function scanText(text, filename) {
   };
 }
 
+// v1.0.1 fix: match "test"/"spec" as a path segment or filename part, not as a
+// substring. The old substring check treated latest.js, inspector.js, special.js,
+// contest/, respect.py ... as test files and skipped secret detection in them.
+// Repro (v1.0.0): plumber_scan_text { text: 'const k = "AKIAIOSFODNN7EXAMPLE";',
+//   filename: "src/latest.js" } -> "No issues found."
+function isTestPath(relPath) {
+  const base = path.basename(relPath);
+  return /(?:^|[\/._-])(?:__tests__|tests?|specs?|testing)(?:[\/._-]|$)/i.test(relPath)
+    || /[a-z0-9](?:Tests?|Specs?)\.\w+$/.test(base)
+    || base.toLowerCase() === 'conftest.py';
+}
+
 function inspectFile(relPath, content, lines, ext) {
   const issues = [];
   const lower = content.toLowerCase();
   const base = path.basename(relPath);
-  const isTest = relPath.toLowerCase().includes('test') || relPath.toLowerCase().includes('spec');
+  const isTest = isTestPath(relPath);
 
   // Environment files must never be committed
   if (base.startsWith('.env') && !ENV_TEMPLATE_RE.test(base)) {
@@ -299,6 +317,7 @@ function findUnreachable(lines, start, indent, skip, isPy) {
 module.exports = {
   RULES,
   SEV_WEIGHT,
+  SCANNABLE_EXTS,
   scanLocalDirectory,
   scanText
 };