@socketsecurity/mcp 0.0.12 → 0.0.14

package/index.js

@@ -50,46 +50,50 @@ async function getApiKeyInteractively() {
     return apiKey;
 }
 let SOCKET_API_KEY = process.env['SOCKET_API_KEY'] || '';
+function buildSocketHeaders() {
+    return {
+        'user-agent': `socket-mcp/${VERSION}`,
+        accept: 'application/x-ndjson',
+        'content-type': 'application/json',
+        authorization: `Bearer ${SOCKET_API_KEY}`
+    };
+}
 const server = new McpServer({
     name: 'socket',
     version: VERSION,
-    description: 'Socket MCP server',
-    capabilities: {
-        resources: {},
-        tools: {},
-        streaming: {}
-    },
 });
-server.tool('depscore', "Get the dependency score of packages with the `depscore` tool from Socket. Use 'unknown' for version if not known. Use this tool to scan dependencies for their quality and security on existing code or when code is generated. Stop generating code and ask the user how to proceed when any of the scores are low. When checking dependencies, make sure to also check the imports in the code, not just the manifest files (pyproject.toml, package.json, etc).", {
-    packages: z.array(z.object({
-        ecosystem: z.string().describe('The package ecosystem (e.g., npm, pypi)').default('npm'),
-        depname: z.string().describe('The name of the dependency'),
-        version: z.string().describe("The version of the dependency, use 'unknown' if not known").default('unknown'),
-    })).describe('Array of packages to check'),
+server.registerTool('depscore', {
+    title: 'Dependency Score Tool',
+    description: "Get the dependency score of packages with the `depscore` tool from Socket. Use 'unknown' for version if not known. Use this tool to scan dependencies for their quality and security on existing code or when code is generated. Stop generating code and ask the user how to proceed when any of the scores are low. When checking dependencies, make sure to also check the imports in the code, not just the manifest files (pyproject.toml, package.json, etc).",
+    inputSchema: z.object({
+        packages: z.array(z.object({
+            ecosystem: z.string().describe('The package ecosystem (e.g., npm, pypi)').default('npm'),
+            depname: z.string().describe('The name of the dependency'),
+            version: z.string().describe("The version of the dependency, use 'unknown' if not known").default('unknown'),
+        })).describe('Array of packages to check'),
+    }),
+    annotations: {
+        readOnlyHint: true,
+    },
 }, async ({ packages }) => {
     logger.info(`Received request for ${packages.length} packages`);
-    const SOCKET_HEADERS = {
-        'user-agent': `socket-mcp/${VERSION}`,
-        accept: 'application/x-ndjson',
-        'content-type': 'application/json',
-        authorization: `Bearer ${SOCKET_API_KEY}`
-    };
     const components = packages.map(pkg => {
-        const cleanedVersion = pkg.version.replace(/[\^~]/g, '');
+        const cleanedVersion = (pkg.version ?? 'unknown').replace(/[\^~]/g, '');
+        const ecosystem = pkg.ecosystem ?? 'npm';
         let purl;
         if (cleanedVersion === '1.0.0' || cleanedVersion === 'unknown' || !cleanedVersion) {
-            purl = `pkg:${pkg.ecosystem}/${pkg.depname}`;
+            purl = `pkg:${ecosystem}/${pkg.depname}`;
         }
         else {
             logger.info(`Using version ${cleanedVersion} for ${pkg.depname}`);
-            purl = `pkg:${pkg.ecosystem}/${pkg.depname}@${cleanedVersion}`;
+            purl = `pkg:${ecosystem}/${pkg.depname}@${cleanedVersion}`;
         }
         return { purl };
     });
     try {
         const response = await fetch(SOCKET_API_URL, {
             method: 'POST',
-            headers: SOCKET_HEADERS,
+            headers: buildSocketHeaders(),
             body: JSON.stringify({ components })
         });
         const responseText = await response.text();
@@ -154,6 +158,9 @@ server.tool('depscore', "Get the dependency score of packages with the `depscore
                         .join(', ');
                     results.push(`${purl}: ${scoreEntries}`);
                 }
+                else {
+                    results.push(`${purl}: No score found`);
+                }
             }
             return {
                 content: [
@@ -203,37 +210,6 @@ if (useHttp) {
     logger.info(`Starting HTTP server on port ${port}`);
     let httpTransport = null;
     const httpServer = createServer(async (req, res) => {
-        const origin = req.headers.origin;
-        const allowedOrigins = [
-            'http://localhost:3000',
-            'http://127.0.0.1:3000',
-            'https://mcp.socket.dev',
-            'https://mcp.socket-staging.dev'
-        ];
-        const isValidOrigin = !origin || allowedOrigins.includes(origin);
-        if (origin && !isValidOrigin) {
-            logger.warn(`Rejected request from invalid origin: ${origin}`);
-            res.writeHead(403, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                jsonrpc: '2.0',
-                error: { code: -32000, message: 'Forbidden: Invalid origin' },
-                id: null
-            }));
-            return;
-        }
-        if (origin && isValidOrigin) {
-            res.setHeader('Access-Control-Allow-Origin', origin);
-        }
-        else {
-            res.setHeader('Access-Control-Allow-Origin', 'http://localhost:3000');
-        }
-        res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Accept');
-        if (req.method === 'OPTIONS') {
-            res.writeHead(200);
-            res.end();
-            return;
-        }
         let url;
         try {
             url = new URL(req.url, `http://localhost:${port}`);
@@ -258,6 +234,32 @@ if (useHttp) {
             }));
             return;
         }
+        const origin = req.headers.origin;
+        const allowedOrigins = [
+            'http://localhost:3000',
+            'http://127.0.0.1:3000',
+            'https://mcp.socket.dev',
+            'https://mcp.socket-staging.dev'
+        ];
+        const isValidOrigin = origin && allowedOrigins.includes(origin);
+        if (!isValidOrigin) {
+            logger.warn(`Rejected request from invalid origin: ${origin}`);
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                jsonrpc: '2.0',
+                error: { code: -32000, message: 'Forbidden: Invalid origin' },
+                id: null
+            }));
+            return;
+        }
+        res.setHeader('Access-Control-Allow-Origin', origin);
+        res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Accept');
+        if (req.method === 'OPTIONS') {
+            res.writeHead(200);
+            res.end();
+            return;
+        }
         if (url.pathname === '/') {
             if (req.method === 'POST') {
                 let body = '';

package/mock-client/stdio-client.js

@@ -9,7 +9,7 @@ async function main() {
         command: 'node',
         args: ['--experimental-strip-types', serverPath],
         env: {
-            ...process.env,
+            ...Object.fromEntries(Object.entries(process.env).filter(([, value]) => value !== undefined)),
             SOCKET_API_KEY: process.env['SOCKET_API_KEY'] || ''
         }
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/mcp",
-  "version": "0.0.12",
+  "version": "0.0.14",
   "type": "module",
   "main": "./index.js",
   "bin": {
@@ -20,10 +20,11 @@
     "build": "npm run clean && run-s build:*",
     "build:types": "tsc -p tsconfig.declaration.json",
     "build:permissions": "chmod +x ./index.js && (chmod +x ./mock-client/*.js 2>/dev/null || true)",
-    "build-dtx": "run-s build build-dtx:*",
-    "build-dtx:versions_match": "node --experimental-strip-types scripts/check-versions.ts",
-    "build-dtx:validate": "npx dxt validate ./",
-    "build-dtx:dtx-pack": "npx dxt pack ./",
+    "build-mcpb": "run-s build build-mcpb:*",
+    "build-mcpb:versions_match": "node --experimental-strip-types scripts/check-versions.ts",
+    "build-mcpb:validate": "npx mcpb validate ./",
+    "build-mcpb:ensure-deps": "npm install --production --ignore-scripts",
+    "build-mcpb:mcpb-pack": "npx mcpb pack ./",
     "clean": "./scripts/clean.sh",
     "debug-stdio": "node --experimental-strip-types ./mock-client/debug-client.ts",
     "debug-sdk": "node --experimental-strip-types ./mock-client/stdio-client.ts",
@@ -33,6 +34,8 @@
   },
   "keywords": [],
   "files": [
+    "package.json",
+    "package-lock.json",
     "index.js",
     "index.d.ts",
     "index.d.ts.map",
@@ -46,14 +49,14 @@
     "url": "https://github.com/SocketDev/socket-mcp"
   },
   "dependencies": {
+    "@anthropic-ai/mcpb": "^1.1.0",
     "@modelcontextprotocol/sdk": "^1.18.0",
-    "pino": "^9.7.0",
+    "pino": "^10.0.0",
     "pino-pretty": "^13.0.0",
     "semver": "^7.7.2",
     "zod": "^3.24.4"
   },
   "devDependencies": {
-    "@anthropic-ai/dxt": "^0.2.0",
     "@types/node": "^24.0.7",
     "@types/semver": "^7.7.0",
     "@types/triple-beam": "^1.3.5",