@perrylink/dsh-cert-mcp 0.1.4 → 0.1.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/src/server.js +9 -2
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@perrylink/dsh-cert-mcp",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.5",
|
|
4
4
|
"description": "Read-only MCP server exposing the dsh-plugin-certification registry: certification grades, snapshots and five-dimension evidence for DeepSeek Harness plugins.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "Apache-2.0",
|
package/src/server.js
CHANGED
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
import { readFile } from 'node:fs/promises'
|
|
6
6
|
|
|
7
7
|
const PROTOCOL_VERSION = '2024-11-05'
|
|
8
|
-
const SERVER_INFO = { name: 'dsh-cert-mcp', version: '0.1.
|
|
8
|
+
const SERVER_INFO = { name: 'dsh-cert-mcp', version: '0.1.5' }
|
|
9
9
|
const REGISTRY_URL = 'https://raw.githubusercontent.com/PerryLink/dsh-plugin-certification/main/data/certified.json'
|
|
10
10
|
const REFRESH_MS = 5 * 60 * 1000
|
|
11
11
|
|
|
@@ -20,7 +20,14 @@ C. supplyChain — OpenSSF Scorecard score with per-check evidence.
|
|
|
20
20
|
D. releaseIntegrity — npm publish --provenance via Trusted Publishing.
|
|
21
21
|
E. installSmoke — real install of the published package into a sandboxed DSH_HOME.
|
|
22
22
|
|
|
23
|
-
Grades
|
|
23
|
+
Grades (spec v1 — the registry README is the owner of these definitions):
|
|
24
|
+
- A — all five pass (E must be "ok"), no veto hit.
|
|
25
|
+
- B — E passes and at least three of A/B/C/D pass. An E that ends "install-fail" purely because of an unattended-environment gate (e.g. pnpm's interactive approve-builds cannot be confirmed in a sandbox) also keeps B when A–D pass, and records "environment-blocked".
|
|
26
|
+
- C — E passes, the rest incomplete.
|
|
27
|
+
- D — any hard gate fails (dsh.bundle missing, no license, malicious pattern hit).
|
|
28
|
+
- Security veto — obfuscated code, credential exfiltration, or surprising install-time behaviour grades D immediately, with the reason published.
|
|
29
|
+
- Environment gates are never recorded as D.
|
|
30
|
+
- Evidence discipline: every score comes from real, reproducible execution; absent evidence is "no-evidence", never a guess.`
|
|
24
31
|
|
|
25
32
|
async function loadRegistry(force = false) {
|
|
26
33
|
if (!registry) {
|