@perrylink/dsh-cert-mcp 0.1.1 → 0.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +10 -1
  2. package/data/certified.json +10 -10
  3. package/package.json +43 -43
  4. package/src/server.js +5 -2
package/README.md CHANGED
@@ -1,5 +1,14 @@
1
1
  # dsh-cert-mcp
2
2
 
3
+ [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
4
+ [![DSH plugin](https://img.shields.io/badge/dsh-plugin-✅-green)](https://github.com/topics/dsh-plugin)
5
+ [![Gitee](https://img.shields.io/badge/Gitee-mirror-c71d23?logo=gitee)](https://gitee.com/perrylink/dsh-cert-mcp)
6
+ [![Version](https://img.shields.io/github/v/tag/PerryLink/dsh-cert-mcp?label=version)](https://github.com/PerryLink/dsh-cert-mcp/releases)
7
+ [![npm version](https://img.shields.io/npm/v/%40perrylink%2Fdsh-cert-mcp)](https://www.npmjs.com/package/@perrylink/dsh-cert-mcp)
8
+ [![npm downloads](https://img.shields.io/npm/dm/%40perrylink%2Fdsh-cert-mcp)](https://www.npmjs.com/package/@perrylink/dsh-cert-mcp)
9
+ [![dsh-cert-mcp MCP server](https://glama.ai/mcp/servers/PerryLink/dsh-cert-mcp/badges/score.svg)](https://glama.ai/mcp/servers/PerryLink/dsh-cert-mcp)
10
+ [![dsh-cert-mcp MCP server](https://glama.ai/mcp/servers/PerryLink/dsh-cert-mcp/badges/card.svg)](https://glama.ai/mcp/servers/PerryLink/dsh-cert-mcp)
11
+
3
12
  Read-only [MCP](https://modelcontextprotocol.io) server that exposes the [dsh-plugin-certification](https://github.com/PerryLink/dsh-plugin-certification) registry: certification grades, snapshot dates and five-dimension evidence for DeepSeek Harness (DSH) plugins. Zero runtime dependencies, stdio transport.
4
13
 
5
14
  ## Tools
@@ -20,7 +29,7 @@ cd dsh-cert-mcp
20
29
  node src/index.js # stdio server
21
30
  ```
22
31
 
23
- After the npm release you will be able to run it directly: `npx @perrylink/dsh-cert-mcp`.
32
+ Run it directly from the published npm package: `npx @perrylink/dsh-cert-mcp`.
24
33
 
25
34
  ### Register in an MCP client
26
35
 
package/data/certified.json CHANGED
@@ -1,37 +1,37 @@
1
1
  {
2
2
  "specVersion": "v1",
3
- "generatedAt": "2026-09-02",
3
+ "generatedAt": "2026-09-07",
4
4
  "entries": [
5
5
  {
6
6
  "repo": "PerryLink/dsh-auto-review",
7
- "grade": "B",
7
+ "grade": "A",
8
8
  "specVersion": "v1",
9
- "snapshot": "2026-09-02",
9
+ "snapshot": "2026-09-07",
10
10
  "dimensions": {
11
11
  "manifest": {
12
12
  "result": "pass",
13
- "evidence": "dsh.bundle manifest + Apache-2.0 + topics/keywords aligned + five-language READMEs + engines ^22.19.0 || >=24.0.0 (repo scan 2026-09-02)"
13
+ "evidence": "dsh.bundle manifest + Apache-2.0 + keywords/topics aligned + five-language READMEs + engines ^22.19.0 || >=24.0.0 (repo + npm registry scan 2026-09-07, v0.10.4)"
14
14
  },
15
15
  "buildHygiene": {
16
16
  "result": "pass",
17
- "evidence": "files allowlist + peerDependencies (optional client peers) + typecheck/test/build/verify:self-contained/pack gates; CI green at v0.10.0 (0.1.2-alpha.5 batch), 276 tests"
17
+ "evidence": "files allowlist + peerDependencies (optional client peers, range >=0.1.2-rc.1 <0.2.0 since 2026-09-05) + typecheck/test/build/check:readmes/pack gates; 2026-09-06 batch D-stage gate chain green at v0.10.4 (frozen install, typecheck, 276/276 tests, build, verify:self-contained, pack) + main ci success on 3f9cdae (2026-09-06T12:32Z); no malicious postinstall patterns"
18
18
  },
19
19
  "supplyChain": {
20
20
  "result": "pass",
21
21
  "score": 5.4,
22
- "evidence": "https://api.securityscorecards.dev/projects/github.com/PerryLink/dsh-auto-review (run 2026-08-30; scorecard workflow upgraded to v2.4.4 ghcr.io image on 2026-09-02, refreshed run pending propagation); checks: Binary-Artifacts 10, CI-Tests 10, Dangerous-Workflow 10, Contributors 3, Code-Review 0, CII-Best-Practices 0"
22
+ "evidence": "https://api.securityscorecards.dev/projects/github.com/PerryLink/dsh-auto-review fresh run 2026-09-06T12:32:32Z on main 3f9cdae (scorecard v5.5.0); Scorecard supply-chain workflow success on the same SHA"
23
23
  },
24
24
  "releaseIntegrity": {
25
25
  "result": "pass",
26
- "evidence": "npm publish --provenance via publish workflow with id-token + Trusted Publishing configured; dsh-auto-review@0.10.0 on npm since 2026-09-02"
26
+ "evidence": "npm publish --provenance via publish workflow with id-token + Trusted Publishing; dsh-auto-review@0.10.4 on npm since 2026-09-05T15:04Z - registry dist.attestations + slsa.dev/provenance/v1 + GitHub Actions trusted publisher verified directly 2026-09-07"
27
27
  },
28
28
  "installSmoke": {
29
- "result": "install-fail",
30
- "evidence": "2026-08-31 sandboxed install (`dsh plugin --profile cert add dsh-auto-review` in mkdtemp DSH_HOME) blocked by pnpm approve-builds interactive gate on the esbuild postinstall; profile-level allowBuilds not honored on the npm registry channel in this environment. CI smoke-package job (tarball install + node-face load through package exports) passes. Classified environment-blocked, not a plugin defect."
29
+ "result": "ok",
30
+ "evidence": "2026-09-06 batch D-stage (isolated throwaway profile, npx @deepseek-ai/dsh@0.1.2-rc.1): the standard `dsh plugin --profile web add <tarball>` fails with ERR_PNPM_IGNORED_BUILDS (pnpm 11 ignored-builds environmental gate); the documented compat recipe (pnpm-workspace.yaml allowBuilds preset for dsh-subprocess-local/koffi/node-pty/protobufjs) then installs cleanly - add exit 0 (resolved 381, added 271), dump-config shows the plugin row + bundle layer, keyless headless reaches MISSING_CREDENTIAL (tree-load proof). Reproduction: _scratch/batch-2026-09-06/verify/dsh-auto-review.md"
31
31
  }
32
32
  },
33
33
  "veto": null,
34
- "notes": "Registry entry refreshed for the 0.1.2-alpha.5 batch (0.10.0 published 2026-09-02). E remains environment-blocked per the spec amendment (environmental install gates keep grade B and must not be recorded as D)."
34
+ "notes": "Registry entry refreshed for 0.10.4 (published 2026-09-05 with OIDC provenance). E upgraded from environment-blocked to ok via the documented allowBuilds compat recipe (the same method the repo's compat.yml uses); the bare unattended install still hits pnpm's ignored-builds gate, recorded above. Grade B -> A."
35
35
  }
36
36
  ]
37
37
  }
package/package.json CHANGED
@@ -1,44 +1,44 @@
1
- {
2
- "name": "@perrylink/dsh-cert-mcp",
3
- "version": "0.1.1",
4
- "description": "Read-only MCP server exposing the dsh-plugin-certification registry: certification grades, snapshots and five-dimension evidence for DeepSeek Harness plugins.",
5
- "type": "module",
6
- "license": "Apache-2.0",
7
- "bin": {
8
- "dsh-cert-mcp": "src/index.js"
9
- },
10
- "files": [
11
- "src",
12
- "data",
13
- "README.md",
14
- "LICENSE"
15
- ],
16
- "engines": {
17
- "node": "\u003e=18"
18
- },
19
- "keywords": [
20
- "mcp",
21
- "mcp-server",
22
- "model-context-protocol",
23
- "deepseek-harness",
24
- "dsh-plugin",
25
- "dsh",
26
- "certification",
27
- "supply-chain-security"
28
- ],
29
- "repository": {
30
- "type": "git",
31
- "url": "https://github.com/PerryLink/dsh-cert-mcp.git"
32
- },
33
- "funding": {
34
- "type": "github",
35
- "url": "https://github.com/sponsors/PerryLink"
36
- },
37
- "scripts": {
38
- "test": "node test/smoke.mjs"
39
- },
40
- "mcpName": "io.github.perrylink/dsh-cert",
41
- "publishConfig": {
42
- "access": "public"
43
- }
1
+ {
2
+ "name": "@perrylink/dsh-cert-mcp",
3
+ "version": "0.1.3",
4
+ "description": "Read-only MCP server exposing the dsh-plugin-certification registry: certification grades, snapshots and five-dimension evidence for DeepSeek Harness plugins.",
5
+ "type": "module",
6
+ "license": "Apache-2.0",
7
+ "bin": {
8
+ "dsh-cert-mcp": "src/index.js"
9
+ },
10
+ "files": [
11
+ "src",
12
+ "data",
13
+ "README.md",
14
+ "LICENSE"
15
+ ],
16
+ "engines": {
17
+ "node": ">=18"
18
+ },
19
+ "keywords": [
20
+ "mcp",
21
+ "mcp-server",
22
+ "model-context-protocol",
23
+ "deepseek-harness",
24
+ "dsh-plugin",
25
+ "dsh",
26
+ "certification",
27
+ "supply-chain-security"
28
+ ],
29
+ "repository": {
30
+ "type": "git",
31
+ "url": "https://github.com/PerryLink/dsh-cert-mcp.git"
32
+ },
33
+ "funding": {
34
+ "type": "github",
35
+ "url": "https://github.com/sponsors/PerryLink"
36
+ },
37
+ "scripts": {
38
+ "test": "node test/smoke.mjs"
39
+ },
40
+ "mcpName": "io.github.perrylink/dsh-cert",
41
+ "publishConfig": {
42
+ "access": "public"
43
+ }
44
44
  }
package/src/server.js CHANGED
@@ -5,7 +5,7 @@
5
5
  import { readFile } from 'node:fs/promises'
6
6
 
7
7
  const PROTOCOL_VERSION = '2024-11-05'
8
- const SERVER_INFO = { name: 'dsh-cert-mcp', version: '0.1.0' }
8
+ const SERVER_INFO = { name: 'dsh-cert-mcp', version: '0.1.3' }
9
9
  const REGISTRY_URL = 'https://raw.githubusercontent.com/PerryLink/dsh-plugin-certification/main/data/certified.json'
10
10
  const REFRESH_MS = 5 * 60 * 1000
11
11
 
@@ -33,7 +33,10 @@ async function loadRegistry(force = false) {
33
33
  }
34
34
  if (force || Date.now() - lastFetch > REFRESH_MS) {
35
35
  try {
36
- const res = await fetch(REGISTRY_URL, { headers: { 'user-agent': 'dsh-cert-mcp' } })
36
+ const res = await fetch(REGISTRY_URL, {
37
+ headers: { 'user-agent': 'dsh-cert-mcp' },
38
+ signal: AbortSignal.timeout(10_000),
39
+ })
37
40
  if (res.ok) {
38
41
  registry = await res.json()
39
42
  lastFetch = Date.now()