@socketsecurity/mcp 0.0.11 → 0.0.13

package/README.md

@@ -25,7 +25,7 @@ The easiest way to get started is to use our public Socket MCP server. **No API
 
 
 [![Install in VS Code](https://img.shields.io/badge/VS_Code-Socket_MCP-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://vscode.dev/redirect/mcp/install?name=socket-mcp&config={"url":"https://mcp.socket.dev/","type":"http"})
-[![Install in Cursor](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/install-mcp?name=socket-mcp&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWNwLnNvY2tldC5kZXYifQ%3D%3D)
+[![Install in Cursor](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=socket-mcp&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWNwLnNvY2tldC5kZXYvIn0%3D)
 
 
 <details><summary><b>Manual Installation Instructions & more MCP Clients</b></summary>
@@ -149,7 +149,7 @@ For local deployment, you have two options:
 Click a button below to install the self-hosted stdio server in your favorite AI assistant.
 
 [![Install in VS Code](https://img.shields.io/badge/VS_Code-Socket_MCP-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://vscode.dev/redirect/mcp/install?name=socket-mcp&config={"command":"npx","args":["@socketsecurity/mcp@latest"],"type":"stdio"})
-[![Install in Cursor (stdio)](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/install-mcp?name=socket-mcp-stdio&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyJAc29ja2V0c2VjdXJpdHkvbWNwQGxhdGVzdCJdLCJlbnYiOnsiU09DS0VUX0FQSV9LRVkiOiJ5b3VyLWFwaS1rZXktaGVyZSJ9fQ==)
+[![Install in Cursor (stdio)](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=socket-mcp&config=eyJjb21tYW5kIjoibnB4IEBzb2NrZXRzZWN1cml0eS9tY3BAbGF0ZXN0IiwiZW52Ijp7IlNPQ0tFVF9BUElfS0VZIjoieW91ci1hcGkta2V5LWhlcmUifX0%3D)
 
 Claude Code (stdio mode) can be set up with the following command:
 
@@ -374,3 +374,12 @@ MCP_HTTP_MODE=true SOCKET_API_KEY=your_api_key_here node --experimental-strip-ty
 - 📖 [Socket Documentation](https://docs.socket.dev)
 - 🐛 [Report Issues](https://github.com/SocketDev/socket-mcp/issues)
 - 💬 [Community Support](https://github.com/SocketDev/socket-mcp/discussions)
+
+<br/>
+<div align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="logo-white.png">
+    <source media="(prefers-color-scheme: light)" srcset="logo-black.png">
+    <img width="324" height="108" alt="Socket Logo" src="logo-black.png">
+  </picture>
+</div>

package/index.js

@@ -9,8 +9,6 @@ import { join } from 'path';
 import { readFileSync } from 'fs';
 import { tmpdir } from 'os';
 import { createServer } from 'http';
-import { randomUUID } from 'crypto';
-import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 const __dirname = import.meta.dirname;
 const packageJson = JSON.parse(readFileSync(join(__dirname, './package.json'), 'utf8'));
 const VERSION = packageJson.version || '0.0.1';
@@ -52,47 +50,50 @@ async function getApiKeyInteractively() {
     return apiKey;
 }
 let SOCKET_API_KEY = process.env['SOCKET_API_KEY'] || '';
-const transports = {};
+function buildSocketHeaders() {
+    return {
+        'user-agent': `socket-mcp/${VERSION}`,
+        accept: 'application/x-ndjson',
+        'content-type': 'application/json',
+        authorization: `Bearer ${SOCKET_API_KEY}`
+    };
+}
 const server = new McpServer({
     name: 'socket',
     version: VERSION,
-    description: 'Socket MCP server',
-    capabilities: {
-        resources: {},
-        tools: {},
-        streaming: {}
-    },
 });
-server.tool('depscore', "Get the dependency score of packages with the `depscore` tool from Socket. Use 'unknown' for version if not known. Use this tool to scan dependencies for their quality and security on existing code or when code is generated. Stop generating code and ask the user how to proceed when any of the scores are low. When checking dependencies, make sure to also check the imports in the code, not just the manifest files (pyproject.toml, package.json, etc).", {
-    packages: z.array(z.object({
-        ecosystem: z.string().describe('The package ecosystem (e.g., npm, pypi)').default('npm'),
-        depname: z.string().describe('The name of the dependency'),
-        version: z.string().describe("The version of the dependency, use 'unknown' if not known").default('unknown'),
-    })).describe('Array of packages to check'),
+server.registerTool('depscore', {
+    title: 'Dependency Score Tool',
+    description: "Get the dependency score of packages with the `depscore` tool from Socket. Use 'unknown' for version if not known. Use this tool to scan dependencies for their quality and security on existing code or when code is generated. Stop generating code and ask the user how to proceed when any of the scores are low. When checking dependencies, make sure to also check the imports in the code, not just the manifest files (pyproject.toml, package.json, etc).",
+    inputSchema: z.object({
+        packages: z.array(z.object({
+            ecosystem: z.string().describe('The package ecosystem (e.g., npm, pypi)').default('npm'),
+            depname: z.string().describe('The name of the dependency'),
+            version: z.string().describe("The version of the dependency, use 'unknown' if not known").default('unknown'),
+        })).describe('Array of packages to check'),
+    }),
+    annotations: {
+        readOnlyHint: true,
+    },
 }, async ({ packages }) => {
     logger.info(`Received request for ${packages.length} packages`);
-    const SOCKET_HEADERS = {
-        'user-agent': `socket-mcp/${VERSION}`,
-        accept: 'application/x-ndjson',
-        'content-type': 'application/json',
-        authorization: `Bearer ${SOCKET_API_KEY}`
-    };
     const components = packages.map(pkg => {
-        const cleanedVersion = pkg.version.replace(/[\^~]/g, '');
+        const cleanedVersion = (pkg.version ?? 'unknown').replace(/[\^~]/g, '');
+        const ecosystem = pkg.ecosystem ?? 'npm';
         let purl;
         if (cleanedVersion === '1.0.0' || cleanedVersion === 'unknown' || !cleanedVersion) {
-            purl = `pkg:${pkg.ecosystem}/${pkg.depname}`;
+            purl = `pkg:${ecosystem}/${pkg.depname}`;
         }
         else {
             logger.info(`Using version ${cleanedVersion} for ${pkg.depname}`);
-            purl = `pkg:${pkg.ecosystem}/${pkg.depname}@${cleanedVersion}`;
+            purl = `pkg:${ecosystem}/${pkg.depname}@${cleanedVersion}`;
         }
         return { purl };
     });
     try {
         const response = await fetch(SOCKET_API_URL, {
             method: 'POST',
-            headers: SOCKET_HEADERS,
+            headers: buildSocketHeaders(),
             body: JSON.stringify({ components })
         });
         const responseText = await response.text();
@@ -157,6 +158,9 @@ server.tool('depscore', "Get the dependency score of packages with the `depscore
                         .join(', ');
                     results.push(`${purl}: ${scoreEntries}`);
                 }
+                else {
+                    results.push(`${purl}: No score found`);
+                }
             }
             return {
                 content: [
@@ -204,6 +208,7 @@ if (!SOCKET_API_KEY) {
 }
 if (useHttp) {
     logger.info(`Starting HTTP server on port ${port}`);
+    let httpTransport = null;
     const httpServer = createServer(async (req, res) => {
         const origin = req.headers.origin;
         const allowedOrigins = [
@@ -212,8 +217,8 @@ if (useHttp) {
             'https://mcp.socket.dev',
             'https://mcp.socket-staging.dev'
         ];
-        const isValidOrigin = !origin || allowedOrigins.includes(origin);
-        if (origin && !isValidOrigin) {
+        const isValidOrigin = origin && allowedOrigins.includes(origin);
+        if (!isValidOrigin) {
             logger.warn(`Rejected request from invalid origin: ${origin}`);
             res.writeHead(403, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({
@@ -229,9 +234,8 @@ if (useHttp) {
         else {
             res.setHeader('Access-Control-Allow-Origin', 'http://localhost:3000');
         }
-        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, mcp-session-id, Accept, Last-Event-ID');
-        res.setHeader('Access-Control-Expose-Headers', 'mcp-session-id');
+        res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Accept');
         if (req.method === 'OPTIONS') {
             res.writeHead(200);
             res.end();
@@ -263,79 +267,34 @@ if (useHttp) {
         }
         if (url.pathname === '/') {
             if (req.method === 'POST') {
-                const acceptHeader = req.headers.accept;
-                if (!acceptHeader || (!acceptHeader.includes('application/json') && !acceptHeader.includes('text/event-stream'))) {
-                    logger.warn(`Invalid Accept header: ${acceptHeader}`);
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({
-                        jsonrpc: '2.0',
-                        error: { code: -32000, message: 'Bad Request: Accept header must include application/json or text/event-stream' },
-                        id: null
-                    }));
-                    return;
-                }
                 let body = '';
                 req.on('data', chunk => (body += chunk));
                 req.on('end', async () => {
                     try {
                         const jsonData = JSON.parse(body);
-                        const sessionId = req.headers['mcp-session-id'];
-                        if (sessionId && !/^[\x21-\x7E]+$/.test(sessionId)) {
-                            logger.warn(`Invalid session ID format: ${sessionId}`);
-                            res.writeHead(400, { 'Content-Type': 'application/json' });
-                            res.end(JSON.stringify({
-                                jsonrpc: '2.0',
-                                error: { code: -32000, message: 'Bad Request: Session ID must contain only visible ASCII characters' },
-                                id: jsonData.id || null
-                            }));
-                            return;
-                        }
-                        let transport;
-                        if (sessionId && transports[sessionId]) {
-                            transport = transports[sessionId];
-                        }
-                        else if (!sessionId) {
-                            const newSessionId = randomUUID();
-                            const isInit = isInitializeRequest(jsonData);
-                            if (isInit) {
-                                logger.info(`Creating new session for initialize request: ${newSessionId}`);
-                            }
-                            else {
-                                logger.warn(`Creating fallback session for non-initialize request: ${newSessionId}`);
-                            }
-                            transport = new StreamableHTTPServerTransport({
-                                sessionIdGenerator: () => newSessionId,
-                                onsessioninitialized: (id) => {
-                                    transports[id] = transport;
-                                    logger.info(`Session initialized: ${id}`);
-                                    res.setHeader('mcp-session-id', id);
+                        if (jsonData && jsonData.method === 'initialize') {
+                            if (httpTransport) {
+                                try {
+                                    httpTransport.close();
                                 }
+                                catch { }
+                            }
+                            httpTransport = new StreamableHTTPServerTransport({
+                                sessionIdGenerator: undefined,
+                                enableJsonResponse: true
                             });
-                            transport.onclose = () => {
-                                const sid = transport.sessionId;
-                                if (sid && transports[sid]) {
-                                    delete transports[sid];
-                                    logger.info(`Session closed: ${sid}`);
-                                }
-                            };
-                            await server.connect(transport);
-                            await transport.handleRequest(req, res, jsonData);
+                            await server.connect(httpTransport);
+                            await httpTransport.handleRequest(req, res, jsonData);
                             return;
                         }
-                        else {
-                            logger.error(`Invalid session ID: ${sessionId}. Active sessions count: ${Object.keys(transports).length}`);
-                            res.writeHead(400);
-                            res.end(JSON.stringify({
-                                jsonrpc: '2.0',
-                                error: {
-                                    code: -32000,
-                                    message: 'Bad Request: Invalid session ID. Please initialize a new session first.'
-                                },
-                                id: jsonData.id || null
-                            }));
-                            return;
+                        if (!httpTransport) {
+                            httpTransport = new StreamableHTTPServerTransport({
+                                sessionIdGenerator: undefined,
+                                enableJsonResponse: true
+                            });
+                            await server.connect(httpTransport);
                         }
-                        await transport.handleRequest(req, res, jsonData);
+                        await httpTransport.handleRequest(req, res, jsonData);
                     }
                     catch (error) {
                         logger.error(`Error processing POST request: ${error}`);
@@ -350,91 +309,6 @@ if (useHttp) {
                     }
                 });
             }
-            else if (req.method === 'GET') {
-                const acceptHeader = req.headers.accept;
-                if (!acceptHeader || !acceptHeader.includes('text/event-stream')) {
-                    logger.warn(`GET request without text/event-stream Accept header: ${acceptHeader}`);
-                    res.writeHead(405, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({
-                        jsonrpc: '2.0',
-                        error: { code: -32000, message: 'Method Not Allowed: GET requires Accept: text/event-stream' },
-                        id: null
-                    }));
-                    return;
-                }
-                const sessionId = req.headers['mcp-session-id'];
-                if (sessionId && !/^[\x21-\x7E]+$/.test(sessionId)) {
-                    logger.warn(`Invalid session ID format in GET request: ${sessionId}`);
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({
-                        jsonrpc: '2.0',
-                        error: { code: -32000, message: 'Bad Request: Session ID must contain only visible ASCII characters' },
-                        id: null
-                    }));
-                    return;
-                }
-                if (!sessionId || !transports[sessionId]) {
-                    logger.warn(`SSE request with invalid session ID: ${sessionId}`);
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({
-                        jsonrpc: '2.0',
-                        error: { code: -32000, message: 'Bad Request: Invalid or missing session ID for SSE stream' },
-                        id: null
-                    }));
-                    return;
-                }
-                const lastEventId = req.headers['last-event-id'];
-                if (lastEventId) {
-                    logger.info(`SSE resumability requested with Last-Event-ID: ${lastEventId}`);
-                }
-                logger.info(`Opening SSE stream for session: ${sessionId}`);
-                req.socket?.setTimeout(0);
-                req.socket?.setKeepAlive(true, 30000);
-                let streamClosed = false;
-                req.on('close', () => {
-                    streamClosed = true;
-                    logger.info(`Client disconnected SSE stream for session: ${sessionId}`);
-                });
-                req.on('aborted', () => {
-                    streamClosed = true;
-                    logger.info(`Client aborted SSE stream for session: ${sessionId}`);
-                });
-                const transport = transports[sessionId];
-                try {
-                    await transport.handleRequest(req, res);
-                    if (!streamClosed && !res.destroyed) {
-                        logger.info(`Transport completed, maintaining SSE stream for session: ${sessionId}`);
-                        const heartbeat = setInterval(() => {
-                            if (streamClosed || res.destroyed) {
-                                clearInterval(heartbeat);
-                                return;
-                            }
-                            try {
-                                res.write(': heartbeat\n\n');
-                            }
-                            catch (error) {
-                                logger.error(error, `Heartbeat error for session ${sessionId}:`);
-                                clearInterval(heartbeat);
-                            }
-                        }, 30000);
-                        req.on('close', () => clearInterval(heartbeat));
-                        res.on('close', () => clearInterval(heartbeat));
-                    }
-                }
-                catch (error) {
-                    logger.error(error, `SSE transport error for session ${sessionId}:`);
-                }
-            }
-            else if (req.method === 'DELETE') {
-                const sessionId = req.headers['mcp-session-id'];
-                if (!sessionId || !transports[sessionId]) {
-                    res.writeHead(400);
-                    res.end('Invalid or missing session ID');
-                    return;
-                }
-                const transport = transports[sessionId];
-                await transport.handleRequest(req, res);
-            }
             else {
                 res.writeHead(405);
                 res.end('Method not allowed');

package/mock-client/http-client.js

@@ -16,10 +16,8 @@ async function parseResponse(response) {
 }
 async function testHTTPMode() {
     const baseUrl = (process.env['MCP_URL'] || 'http://localhost:3000').replace(/\/$/, '');
-    const sessionId = `test-session-${Date.now()}`;
     console.log('Testing Socket MCP in HTTP mode...');
     console.log(`Server URL: ${baseUrl}`);
-    console.log(`Session ID: ${sessionId}`);
     try {
         console.log('\n1. Initializing connection...');
         const initRequest = {
@@ -46,9 +44,7 @@ async function testHTTPMode() {
         });
         const initResult = await parseResponse(initResponse);
         console.log('Initialize response:', JSON.stringify(initResult, null, 2));
-        const serverSessionId = initResponse.headers.get('mcp-session-id');
-        const actualSessionId = serverSessionId || sessionId;
-        console.log('Session ID:', actualSessionId);
+        console.log('Initialized (stateless)');
         console.log('\n2. Listing available tools...');
         const toolsRequest = {
             jsonrpc: '2.0',
@@ -60,13 +56,18 @@ async function testHTTPMode() {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
-                Accept: 'application/json, text/event-stream',
-                'mcp-session-id': actualSessionId
+                Accept: 'application/json, text/event-stream'
             },
             body: JSON.stringify(toolsRequest)
         });
         const toolsResult = await parseResponse(toolsResponse);
         console.log('Available tools:', JSON.stringify(toolsResult, null, 2));
+        if (!toolsResult ||
+            !toolsResult.result ||
+            !Array.isArray(toolsResult.result.tools) ||
+            !toolsResult.result.tools.some((tool) => tool.name === 'depscore')) {
+            throw new Error('depscore tool not found in available tools');
+        }
         console.log('\n3. Calling depscore tool...');
         const depscoreRequest = {
             jsonrpc: '2.0',
@@ -87,32 +88,13 @@ async function testHTTPMode() {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
-                Accept: 'application/json, text/event-stream',
-                'mcp-session-id': actualSessionId
+                Accept: 'application/json, text/event-stream'
             },
             body: JSON.stringify(depscoreRequest)
         });
         const depscoreResult = await parseResponse(depscoreResponse);
         console.log('Depscore result:', JSON.stringify(depscoreResult, null, 2));
-        console.log('\n4. Testing SSE stream connection...');
-        const sseResponse = await fetch(`${baseUrl}/`, {
-            method: 'GET',
-            headers: {
-                'mcp-session-id': actualSessionId,
-                Accept: 'text/event-stream'
-            }
-        });
-        if (sseResponse.ok) {
-            console.log('SSE stream connected successfully');
-        }
-        console.log('\n5. Cleaning up session...');
-        const cleanupResponse = await fetch(`${baseUrl}/`, {
-            method: 'DELETE',
-            headers: {
-                'mcp-session-id': actualSessionId
-            }
-        });
-        console.log('Session cleanup:', cleanupResponse.status === 200 ? 'Success' : 'Failed');
+        console.log('\n4. HTTP mode test complete (no sessions)');
     }
     catch (error) {
         console.error('Error:', error);

package/mock-client/stdio-client.js

@@ -9,7 +9,7 @@ async function main() {
         command: 'node',
         args: ['--experimental-strip-types', serverPath],
         env: {
-            ...process.env,
+            ...Object.fromEntries(Object.entries(process.env).filter(([, value]) => value !== undefined)),
             SOCKET_API_KEY: process.env['SOCKET_API_KEY'] || ''
         }
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/mcp",
-  "version": "0.0.11",
+  "version": "0.0.13",
   "type": "module",
   "main": "./index.js",
   "bin": {
@@ -20,19 +20,22 @@
     "build": "npm run clean && run-s build:*",
     "build:types": "tsc -p tsconfig.declaration.json",
     "build:permissions": "chmod +x ./index.js && (chmod +x ./mock-client/*.js 2>/dev/null || true)",
-    "build-dtx": "run-s build build-dtx:*",
-    "build-dtx:versions_match": "node --experimental-strip-types scripts/check-versions.ts",
-    "build-dtx:validate": "npx dxt validate ./",
-    "build-dtx:dtx-pack": "npx dxt pack ./",
+    "build-mcpb": "run-s build build-mcpb:*",
+    "build-mcpb:versions_match": "node --experimental-strip-types scripts/check-versions.ts",
+    "build-mcpb:validate": "npx mcpb validate ./",
+    "build-mcpb:ensure-deps": "npm install --production --ignore-scripts",
+    "build-mcpb:mcpb-pack": "npx mcpb pack ./",
     "clean": "./scripts/clean.sh",
     "debug-stdio": "node --experimental-strip-types ./mock-client/debug-client.ts",
     "debug-sdk": "node --experimental-strip-types ./mock-client/stdio-client.ts",
     "debug-http": "node --experimental-strip-types ./mock-client/http-client.ts",
-    "server-stdio": "SOCKET_API_KEY=${SOCKET_API_KEY} --experimental-strip-types ./index.ts",
-    "server-http": "MCP_HTTP_MODE=true SOCKET_API_KEY=${SOCKET_API_KEY} ./build/index.js"
+    "server-stdio": "SOCKET_API_KEY=${SOCKET_API_KEY} node --experimental-strip-types ./index.ts",
+    "server-http": "MCP_HTTP_MODE=true SOCKET_API_KEY=${SOCKET_API_KEY} node  --experimental-strip-types ./index.ts"
   },
   "keywords": [],
   "files": [
+    "package.json",
+    "package-lock.json",
     "index.js",
     "index.d.ts",
     "index.d.ts.map",
@@ -46,19 +49,19 @@
     "url": "https://github.com/SocketDev/socket-mcp"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.11.3",
-    "pino": "^9.7.0",
+    "@anthropic-ai/mcpb": "^1.1.0",
+    "@modelcontextprotocol/sdk": "^1.18.0",
+    "pino": "^10.0.0",
     "pino-pretty": "^13.0.0",
     "semver": "^7.7.2",
     "zod": "^3.24.4"
   },
   "devDependencies": {
-    "neostandard": "^0.12.0",
-    "@anthropic-ai/dxt": "^0.2.0",
     "@types/node": "^24.0.7",
     "@types/semver": "^7.7.0",
     "@types/triple-beam": "^1.3.5",
     "c8": "^10.0.0",
+    "neostandard": "^0.12.0",
     "npm-run-all2": "^8.0.1",
     "typescript": "~5.9.2"
   }