@prereason/mcp 0.1.7 → 0.1.9

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.1.9 (2026-03-10)
+
+- Expand `socket.yml` to suppress all known-safe transitive dependency alerts from `@modelcontextprotocol/sdk`
+- Covers eval (ajv), shell (cross-spawn), filesystem (express/send), debug, dynamic require, unmaintained micro-packages, and more
+
+## 0.1.8 (2026-03-05)
+
+- Remove `createRequire` / dynamic `require('../package.json')` — hardcode version constants
+- Eliminates Socket.dev "Dynamic require" and "Filesystem access" findings from our code
+- Add `socket.yml` for GitHub PR alert suppression of expected behaviors (network access, env vars)
+
 ## 0.1.7 (2026-03-04)
 
 - Pin `@modelcontextprotocol/sdk` to exact `1.27.1` (fixes transitive CVEs in hono and qs)

package/bin/cli.js

@@ -17,17 +17,17 @@
  *   PREREASON_URL       Override the default endpoint URL
  */
 
-import { createRequire } from 'node:module';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
 
+// Keep in sync with package.json on each release
+const PKG_NAME = '@prereason/mcp';
+const PKG_VERSION = '0.1.9';
 const DEFAULT_URL = 'https://api.prereason.com/api/mcp';
 
 // --- Help / Version ---
 if (process.argv.includes('--help') || process.argv.includes('-h')) {
-  const require = createRequire(import.meta.url);
-  const pkg = require('../package.json');
-  process.stderr.write(`${pkg.name} v${pkg.version}\n\n`);
+  process.stderr.write(`${PKG_NAME} v${PKG_VERSION}\n\n`);
   process.stderr.write('Usage:\n');
   process.stderr.write('  npx @prereason/mcp\n');
   process.stderr.write('  npx @prereason/mcp [--header Key:Value]...\n\n');
@@ -43,9 +43,7 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
 }
 
 if (process.argv.includes('--version') || process.argv.includes('-v')) {
-  const require = createRequire(import.meta.url);
-  const pkg = require('../package.json');
-  process.stderr.write(`${pkg.version}\n`);
+  process.stderr.write(`${PKG_VERSION}\n`);
   process.exit(0);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prereason/mcp",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "type": "module",
   "description": "MCP server for pre-analyzed Bitcoin and macro financial intelligence. 17 context templates with trend interpretation, momentum analysis, and cross-asset correlations.",
   "bin": {