@socketsecurity/mcp 0.0.10 → 0.0.12

package/README.md

@@ -25,7 +25,7 @@ The easiest way to get started is to use our public Socket MCP server. **No API
 
 
 [![Install in VS Code](https://img.shields.io/badge/VS_Code-Socket_MCP-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://vscode.dev/redirect/mcp/install?name=socket-mcp&config={"url":"https://mcp.socket.dev/","type":"http"})
-[![Install in Cursor](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/install-mcp?name=socket-mcp&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWNwLnNvY2tldC5kZXYifQ%3D%3D)
+[![Install in Cursor](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=socket-mcp&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWNwLnNvY2tldC5kZXYvIn0%3D)
 
 
 <details><summary><b>Manual Installation Instructions & more MCP Clients</b></summary>
@@ -149,7 +149,7 @@ For local deployment, you have two options:
 Click a button below to install the self-hosted stdio server in your favorite AI assistant.
 
 [![Install in VS Code](https://img.shields.io/badge/VS_Code-Socket_MCP-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://vscode.dev/redirect/mcp/install?name=socket-mcp&config={"command":"npx","args":["@socketsecurity/mcp@latest"],"type":"stdio"})
-[![Install in Cursor (stdio)](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/install-mcp?name=socket-mcp-stdio&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyJAc29ja2V0c2VjdXJpdHkvbWNwQGxhdGVzdCJdLCJlbnYiOnsiU09DS0VUX0FQSV9LRVkiOiJ5b3VyLWFwaS1rZXktaGVyZSJ9fQ==)
+[![Install in Cursor (stdio)](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=socket-mcp&config=eyJjb21tYW5kIjoibnB4IEBzb2NrZXRzZWN1cml0eS9tY3BAbGF0ZXN0IiwiZW52Ijp7IlNPQ0tFVF9BUElfS0VZIjoieW91ci1hcGkta2V5LWhlcmUifX0%3D)
 
 Claude Code (stdio mode) can be set up with the following command:
 
@@ -374,3 +374,12 @@ MCP_HTTP_MODE=true SOCKET_API_KEY=your_api_key_here node --experimental-strip-ty
 - 📖 [Socket Documentation](https://docs.socket.dev)
 - 🐛 [Report Issues](https://github.com/SocketDev/socket-mcp/issues)
 - 💬 [Community Support](https://github.com/SocketDev/socket-mcp/discussions)
+
+<br/>
+<div align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="logo-white.png">
+    <source media="(prefers-color-scheme: light)" srcset="logo-black.png">
+    <img width="324" height="108" alt="Socket Logo" src="logo-black.png">
+  </picture>
+</div>

package/index.d.ts

@@ -1,3 +1,3 @@
-#!/usr/bin/env node --experimental-strip-types
+#!/usr/bin/env -S node --experimental-strip-types
 export {};
 //# sourceMappingURL=index.d.ts.map

package/index.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node --experimental-strip-types
+#!/usr/bin/env -S node --experimental-strip-types
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
@@ -9,8 +9,6 @@ import { join } from 'path';
 import { readFileSync } from 'fs';
 import { tmpdir } from 'os';
 import { createServer } from 'http';
-import { randomUUID } from 'crypto';
-import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 const __dirname = import.meta.dirname;
 const packageJson = JSON.parse(readFileSync(join(__dirname, './package.json'), 'utf8'));
 const VERSION = packageJson.version || '0.0.1';
@@ -52,7 +50,6 @@ async function getApiKeyInteractively() {
     return apiKey;
 }
 let SOCKET_API_KEY = process.env['SOCKET_API_KEY'] || '';
-const transports = {};
 const server = new McpServer({
     name: 'socket',
     version: VERSION,
@@ -204,6 +201,7 @@ if (!SOCKET_API_KEY) {
 }
 if (useHttp) {
     logger.info(`Starting HTTP server on port ${port}`);
+    let httpTransport = null;
     const httpServer = createServer(async (req, res) => {
         const origin = req.headers.origin;
         const allowedOrigins = [
@@ -229,9 +227,8 @@ if (useHttp) {
         else {
             res.setHeader('Access-Control-Allow-Origin', 'http://localhost:3000');
         }
-        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, mcp-session-id, Accept, Last-Event-ID');
-        res.setHeader('Access-Control-Expose-Headers', 'mcp-session-id');
+        res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Accept');
         if (req.method === 'OPTIONS') {
             res.writeHead(200);
             res.end();
@@ -263,79 +260,34 @@ if (useHttp) {
         }
         if (url.pathname === '/') {
             if (req.method === 'POST') {
-                const acceptHeader = req.headers.accept;
-                if (!acceptHeader || (!acceptHeader.includes('application/json') && !acceptHeader.includes('text/event-stream'))) {
-                    logger.warn(`Invalid Accept header: ${acceptHeader}`);
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({
-                        jsonrpc: '2.0',
-                        error: { code: -32000, message: 'Bad Request: Accept header must include application/json or text/event-stream' },
-                        id: null
-                    }));
-                    return;
-                }
                 let body = '';
                 req.on('data', chunk => (body += chunk));
                 req.on('end', async () => {
                     try {
                         const jsonData = JSON.parse(body);
-                        const sessionId = req.headers['mcp-session-id'];
-                        if (sessionId && !/^[\x21-\x7E]+$/.test(sessionId)) {
-                            logger.warn(`Invalid session ID format: ${sessionId}`);
-                            res.writeHead(400, { 'Content-Type': 'application/json' });
-                            res.end(JSON.stringify({
-                                jsonrpc: '2.0',
-                                error: { code: -32000, message: 'Bad Request: Session ID must contain only visible ASCII characters' },
-                                id: jsonData.id || null
-                            }));
-                            return;
-                        }
-                        let transport;
-                        if (sessionId && transports[sessionId]) {
-                            transport = transports[sessionId];
-                        }
-                        else if (!sessionId) {
-                            const newSessionId = randomUUID();
-                            const isInit = isInitializeRequest(jsonData);
-                            if (isInit) {
-                                logger.info(`Creating new session for initialize request: ${newSessionId}`);
-                            }
-                            else {
-                                logger.warn(`Creating fallback session for non-initialize request: ${newSessionId}`);
-                            }
-                            transport = new StreamableHTTPServerTransport({
-                                sessionIdGenerator: () => newSessionId,
-                                onsessioninitialized: (id) => {
-                                    transports[id] = transport;
-                                    logger.info(`Session initialized: ${id}`);
-                                    res.setHeader('mcp-session-id', id);
+                        if (jsonData && jsonData.method === 'initialize') {
+                            if (httpTransport) {
+                                try {
+                                    httpTransport.close();
                                 }
+                                catch { }
+                            }
+                            httpTransport = new StreamableHTTPServerTransport({
+                                sessionIdGenerator: undefined,
+                                enableJsonResponse: true
                             });
-                            transport.onclose = () => {
-                                const sid = transport.sessionId;
-                                if (sid && transports[sid]) {
-                                    delete transports[sid];
-                                    logger.info(`Session closed: ${sid}`);
-                                }
-                            };
-                            await server.connect(transport);
-                            await transport.handleRequest(req, res, jsonData);
+                            await server.connect(httpTransport);
+                            await httpTransport.handleRequest(req, res, jsonData);
                             return;
                         }
-                        else {
-                            logger.error(`Invalid session ID: ${sessionId}. Active sessions count: ${Object.keys(transports).length}`);
-                            res.writeHead(400);
-                            res.end(JSON.stringify({
-                                jsonrpc: '2.0',
-                                error: {
-                                    code: -32000,
-                                    message: 'Bad Request: Invalid session ID. Please initialize a new session first.'
-                                },
-                                id: jsonData.id || null
-                            }));
-                            return;
+                        if (!httpTransport) {
+                            httpTransport = new StreamableHTTPServerTransport({
+                                sessionIdGenerator: undefined,
+                                enableJsonResponse: true
+                            });
+                            await server.connect(httpTransport);
                         }
-                        await transport.handleRequest(req, res, jsonData);
+                        await httpTransport.handleRequest(req, res, jsonData);
                     }
                     catch (error) {
                         logger.error(`Error processing POST request: ${error}`);
@@ -350,91 +302,6 @@ if (useHttp) {
                     }
                 });
             }
-            else if (req.method === 'GET') {
-                const acceptHeader = req.headers.accept;
-                if (!acceptHeader || !acceptHeader.includes('text/event-stream')) {
-                    logger.warn(`GET request without text/event-stream Accept header: ${acceptHeader}`);
-                    res.writeHead(405, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({
-                        jsonrpc: '2.0',
-                        error: { code: -32000, message: 'Method Not Allowed: GET requires Accept: text/event-stream' },
-                        id: null
-                    }));
-                    return;
-                }
-                const sessionId = req.headers['mcp-session-id'];
-                if (sessionId && !/^[\x21-\x7E]+$/.test(sessionId)) {
-                    logger.warn(`Invalid session ID format in GET request: ${sessionId}`);
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({
-                        jsonrpc: '2.0',
-                        error: { code: -32000, message: 'Bad Request: Session ID must contain only visible ASCII characters' },
-                        id: null
-                    }));
-                    return;
-                }
-                if (!sessionId || !transports[sessionId]) {
-                    logger.warn(`SSE request with invalid session ID: ${sessionId}`);
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({
-                        jsonrpc: '2.0',
-                        error: { code: -32000, message: 'Bad Request: Invalid or missing session ID for SSE stream' },
-                        id: null
-                    }));
-                    return;
-                }
-                const lastEventId = req.headers['last-event-id'];
-                if (lastEventId) {
-                    logger.info(`SSE resumability requested with Last-Event-ID: ${lastEventId}`);
-                }
-                logger.info(`Opening SSE stream for session: ${sessionId}`);
-                req.socket?.setTimeout(0);
-                req.socket?.setKeepAlive(true, 30000);
-                let streamClosed = false;
-                req.on('close', () => {
-                    streamClosed = true;
-                    logger.info(`Client disconnected SSE stream for session: ${sessionId}`);
-                });
-                req.on('aborted', () => {
-                    streamClosed = true;
-                    logger.info(`Client aborted SSE stream for session: ${sessionId}`);
-                });
-                const transport = transports[sessionId];
-                try {
-                    await transport.handleRequest(req, res);
-                    if (!streamClosed && !res.destroyed) {
-                        logger.info(`Transport completed, maintaining SSE stream for session: ${sessionId}`);
-                        const heartbeat = setInterval(() => {
-                            if (streamClosed || res.destroyed) {
-                                clearInterval(heartbeat);
-                                return;
-                            }
-                            try {
-                                res.write(': heartbeat\n\n');
-                            }
-                            catch (error) {
-                                logger.error(error, `Heartbeat error for session ${sessionId}:`);
-                                clearInterval(heartbeat);
-                            }
-                        }, 30000);
-                        req.on('close', () => clearInterval(heartbeat));
-                        res.on('close', () => clearInterval(heartbeat));
-                    }
-                }
-                catch (error) {
-                    logger.error(error, `SSE transport error for session ${sessionId}:`);
-                }
-            }
-            else if (req.method === 'DELETE') {
-                const sessionId = req.headers['mcp-session-id'];
-                if (!sessionId || !transports[sessionId]) {
-                    res.writeHead(400);
-                    res.end('Invalid or missing session ID');
-                    return;
-                }
-                const transport = transports[sessionId];
-                await transport.handleRequest(req, res);
-            }
             else {
                 res.writeHead(405);
                 res.end('Method not allowed');

package/mock-client/http-client.js

@@ -16,10 +16,8 @@ async function parseResponse(response) {
 }
 async function testHTTPMode() {
     const baseUrl = (process.env['MCP_URL'] || 'http://localhost:3000').replace(/\/$/, '');
-    const sessionId = `test-session-${Date.now()}`;
     console.log('Testing Socket MCP in HTTP mode...');
     console.log(`Server URL: ${baseUrl}`);
-    console.log(`Session ID: ${sessionId}`);
     try {
         console.log('\n1. Initializing connection...');
         const initRequest = {
@@ -46,9 +44,7 @@ async function testHTTPMode() {
         });
         const initResult = await parseResponse(initResponse);
         console.log('Initialize response:', JSON.stringify(initResult, null, 2));
-        const serverSessionId = initResponse.headers.get('mcp-session-id');
-        const actualSessionId = serverSessionId || sessionId;
-        console.log('Session ID:', actualSessionId);
+        console.log('Initialized (stateless)');
         console.log('\n2. Listing available tools...');
         const toolsRequest = {
             jsonrpc: '2.0',
@@ -60,13 +56,18 @@ async function testHTTPMode() {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
-                Accept: 'application/json, text/event-stream',
-                'mcp-session-id': actualSessionId
+                Accept: 'application/json, text/event-stream'
             },
             body: JSON.stringify(toolsRequest)
         });
         const toolsResult = await parseResponse(toolsResponse);
         console.log('Available tools:', JSON.stringify(toolsResult, null, 2));
+        if (!toolsResult ||
+            !toolsResult.result ||
+            !Array.isArray(toolsResult.result.tools) ||
+            !toolsResult.result.tools.some((tool) => tool.name === 'depscore')) {
+            throw new Error('depscore tool not found in available tools');
+        }
         console.log('\n3. Calling depscore tool...');
         const depscoreRequest = {
             jsonrpc: '2.0',
@@ -87,32 +88,13 @@ async function testHTTPMode() {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
-                Accept: 'application/json, text/event-stream',
-                'mcp-session-id': actualSessionId
+                Accept: 'application/json, text/event-stream'
             },
             body: JSON.stringify(depscoreRequest)
         });
         const depscoreResult = await parseResponse(depscoreResponse);
         console.log('Depscore result:', JSON.stringify(depscoreResult, null, 2));
-        console.log('\n4. Testing SSE stream connection...');
-        const sseResponse = await fetch(`${baseUrl}/`, {
-            method: 'GET',
-            headers: {
-                'mcp-session-id': actualSessionId,
-                Accept: 'text/event-stream'
-            }
-        });
-        if (sseResponse.ok) {
-            console.log('SSE stream connected successfully');
-        }
-        console.log('\n5. Cleaning up session...');
-        const cleanupResponse = await fetch(`${baseUrl}/`, {
-            method: 'DELETE',
-            headers: {
-                'mcp-session-id': actualSessionId
-            }
-        });
-        console.log('Session cleanup:', cleanupResponse.status === 200 ? 'Success' : 'Failed');
+        console.log('\n4. HTTP mode test complete (no sessions)');
     }
     catch (error) {
         console.error('Error:', error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/mcp",
-  "version": "0.0.10",
+  "version": "0.0.12",
   "type": "module",
   "main": "./index.js",
   "bin": {
@@ -28,8 +28,8 @@
     "debug-stdio": "node --experimental-strip-types ./mock-client/debug-client.ts",
     "debug-sdk": "node --experimental-strip-types ./mock-client/stdio-client.ts",
     "debug-http": "node --experimental-strip-types ./mock-client/http-client.ts",
-    "server-stdio": "SOCKET_API_KEY=${SOCKET_API_KEY} --experimental-strip-types ./index.ts",
-    "server-http": "MCP_HTTP_MODE=true SOCKET_API_KEY=${SOCKET_API_KEY} ./build/index.js"
+    "server-stdio": "SOCKET_API_KEY=${SOCKET_API_KEY} node --experimental-strip-types ./index.ts",
+    "server-http": "MCP_HTTP_MODE=true SOCKET_API_KEY=${SOCKET_API_KEY} node  --experimental-strip-types ./index.ts"
   },
   "keywords": [],
   "files": [
@@ -46,19 +46,19 @@
     "url": "https://github.com/SocketDev/socket-mcp"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.11.3",
+    "@modelcontextprotocol/sdk": "^1.18.0",
     "pino": "^9.7.0",
     "pino-pretty": "^13.0.0",
     "semver": "^7.7.2",
     "zod": "^3.24.4"
   },
   "devDependencies": {
-    "neostandard": "^0.12.0",
     "@anthropic-ai/dxt": "^0.2.0",
     "@types/node": "^24.0.7",
     "@types/semver": "^7.7.0",
     "@types/triple-beam": "^1.3.5",
     "c8": "^10.0.0",
+    "neostandard": "^0.12.0",
     "npm-run-all2": "^8.0.1",
     "typescript": "~5.9.2"
   }