@socketsecurity/mcp 0.0.18 → 0.0.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/CHANGELOG.md +17 -0
  2. package/README.md +120 -7
  3. package/dist/index.cjs +950 -866
  4. package/hooks/socket-gate/index.mts +16 -9
  5. package/hooks/socket-gate/socket-gate.cjs +94 -94
  6. package/package.json +17 -12
  7. package/dist/index.d.ts +0 -4
package/hooks/socket-gate/index.mts CHANGED
@@ -36,22 +36,27 @@ const MCP_URL = 'https://mcp.socket.dev/'
36
36
  const SUPPLY_CHAIN_THRESHOLD = 20
37
37
  const REQUEST_TIMEOUT_MS = 10_000
38
38
 
39
- type Ecosystem = 'npm' | 'pypi' | 'cargo' | 'gem' | 'golang' | 'nuget'
39
+ export type Ecosystem = 'npm' | 'pypi' | 'cargo' | 'gem' | 'golang' | 'nuget'
40
40
 
41
- interface HookInput {
41
+ export interface HookInput {
42
42
  session_id: string
43
43
  tool_name: string
44
44
  tool_input: Record<string, unknown> | string
45
45
  }
46
46
 
47
+ // Each pattern matches "<tool> <install-subcommand> <pkg>" and captures the
48
+ // first non-flag argument ([^\s-] rejects a leading dash, [^\s]* takes the
49
+ // rest) as the package spec to scan. The (?:…) groups list a tool's install
50
+ // aliases (npm add|i|install, cargo add|install, go get|install) without
51
+ // capturing them.
47
52
  const INSTALL_PATTERNS: Array<{ ecosystem: Ecosystem; pattern: RegExp }> = [
48
- { ecosystem: 'npm', pattern: /\bnpm\s+(?:add|i|install)\s+([^\s-][^\s]*)/i },
53
+ { ecosystem: 'npm', pattern: /\bnpm\s+(?:add|i|install)\s+([^\s-][^\s]*)/i }, // socket-lint: allow uncommented-regex
49
54
  { ecosystem: 'npm', pattern: /\byarn\s+add\s+([^\s-][^\s]*)/i },
50
55
  { ecosystem: 'npm', pattern: /\bpnpm\s+add\s+([^\s-][^\s]*)/i },
51
56
  { ecosystem: 'npm', pattern: /\bbun\s+add\s+([^\s-][^\s]*)/i },
52
57
  {
53
58
  ecosystem: 'pypi',
54
- pattern: /(?:\bpython3?\s+-m\s+)?\bpip3?\s+install\s+([^\s-][^\s]*)/i,
59
+ pattern: /(?:\bpython3?\s+-m\s+)?\bpip3?\s+install\s+([^\s-][^\s]*)/i, // socket-lint: allow uncommented-regex
55
60
  },
56
61
  { ecosystem: 'pypi', pattern: /\buv\s+add\s+([^\s-][^\s]*)/i },
57
62
  { ecosystem: 'pypi', pattern: /\buv\s+pip\s+install\s+([^\s-][^\s]*)/i },
@@ -59,11 +64,11 @@ const INSTALL_PATTERNS: Array<{ ecosystem: Ecosystem; pattern: RegExp }> = [
59
64
  { ecosystem: 'pypi', pattern: /\bpipenv\s+install\s+([^\s-][^\s]*)/i },
60
65
  {
61
66
  ecosystem: 'cargo',
62
- pattern: /\bcargo\s+(?:add|install)\s+([^\s-][^\s]*)/i,
67
+ pattern: /\bcargo\s+(?:add|install)\s+([^\s-][^\s]*)/i, // socket-lint: allow uncommented-regex
63
68
  },
64
69
  { ecosystem: 'gem', pattern: /\bgem\s+install\s+([^\s-][^\s]*)/i },
65
70
  { ecosystem: 'gem', pattern: /\bbundle\s+add\s+([^\s-][^\s]*)/i },
66
- { ecosystem: 'golang', pattern: /\bgo\s+(?:get|install)\s+([^\s-][^\s]*)/i },
71
+ { ecosystem: 'golang', pattern: /\bgo\s+(?:get|install)\s+([^\s-][^\s]*)/i }, // socket-lint: allow uncommented-regex
67
72
  { ecosystem: 'nuget', pattern: /\bdotnet\s+add\s+package\s+([^\s-][^\s]*)/i },
68
73
  { ecosystem: 'nuget', pattern: /\bnuget\s+install\s+([^\s-][^\s]*)/i },
69
74
  ]
@@ -184,7 +189,7 @@ export function outputAllow(): void {
184
189
  permissionDecision: 'allow',
185
190
  },
186
191
  })
187
- process.stdout.write(payload) // socket-hook: allow console
192
+ process.stdout.write(payload) // socket-lint: allow (process-stdio: stdout is the hook decision protocol; raw write keeps the bundled hook free of logger indirection)
188
193
  }
189
194
 
190
195
  export function outputDeny(reason: string): void {
@@ -195,10 +200,12 @@ export function outputDeny(reason: string): void {
195
200
  permissionDecisionReason: reason,
196
201
  },
197
202
  })
198
- process.stdout.write(payload) // socket-hook: allow console
203
+ process.stdout.write(payload) // socket-lint: allow (process-stdio: stdout is the hook decision protocol; raw write keeps the bundled hook free of logger indirection)
199
204
  }
200
205
 
201
206
  export function parseSupplyChainScore(text: string): number | undefined {
207
+ // "supplyChain:" then optional spaces, capturing an integer with an
208
+ // optional ".<fraction>" decimal part (e.g. "supplyChain: 0.82").
202
209
  const match = text.match(/supplyChain:\s*(\d+(?:\.\d+)?)/i)
203
210
  return match ? Number(match[1]) : undefined
204
211
  }
@@ -274,7 +281,7 @@ async function main(): Promise<void> {
274
281
  // not a hard gate — see the file header). Surface the error on stderr so
275
282
  // the failure is observable; stdout stays the allow/deny IPC channel.
276
283
  const errLine = `socket-gate: check failed for ${target.ecosystem}/${target.name}, failing open: ${errorMessage(e)}\n`
277
- process.stderr.write(errLine) // socket-hook: allow console
284
+ process.stderr.write(errLine) // socket-lint: allow (process-stdio: stderr feedback for the harness; raw write keeps the bundled hook free of logger indirection)
278
285
  outputAllow()
279
286
  }
280
287
  }
package/hooks/socket-gate/socket-gate.cjs CHANGED
@@ -10,7 +10,7 @@ let node_fs = require("node:fs");
10
10
  let node_process = require("node:process");
11
11
  let node_url = require("node:url");
12
12
 
13
- //#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/constants/sentinels.js
13
+ //#region node_modules/.pnpm/@socketsecurity+lib@6.0.8/node_modules/@socketsecurity/lib/dist/constants/sentinels.js
14
14
  var require_sentinels = /* @__PURE__ */ __commonJSMin(((exports) => {
15
15
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
16
16
  /**
@@ -44,7 +44,7 @@ var require_sentinels = /* @__PURE__ */ __commonJSMin(((exports) => {
44
44
  }));
45
45
 
46
46
  //#endregion
47
- //#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/constants/runtime.js
47
+ //#region node_modules/.pnpm/@socketsecurity+lib@6.0.8/node_modules/@socketsecurity/lib/dist/constants/runtime.js
48
48
  var require_runtime = /* @__PURE__ */ __commonJSMin(((exports) => {
49
49
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
50
50
  /**
@@ -75,14 +75,14 @@ var require_runtime = /* @__PURE__ */ __commonJSMin(((exports) => {
75
75
  }));
76
76
 
77
77
  //#endregion
78
- //#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/node/module.js
78
+ //#region node_modules/.pnpm/@socketsecurity+lib@6.0.8/node_modules/@socketsecurity/lib/dist/node/module.js
79
79
  var require_module = /* @__PURE__ */ __commonJSMin(((exports) => {
80
80
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
81
81
  const require_constants_runtime = require_runtime();
82
82
  let cachedModule;
83
83
  function getNodeModule() {
84
84
  if (!require_constants_runtime.IS_NODE) return;
85
- return cachedModule ??= /*@__PURE__*/ require("node:module");
85
+ return cachedModule ??= /*@__PURE__*/ require("module");
86
86
  }
87
87
  /**
88
88
  * Lazy + cached reference to `node:module`'s `isBuiltin(name)`. First call
@@ -105,7 +105,7 @@ var require_module = /* @__PURE__ */ __commonJSMin(((exports) => {
105
105
  }));
106
106
 
107
107
  //#endregion
108
- //#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/smol/detect.js
108
+ //#region node_modules/.pnpm/@socketsecurity+lib@6.0.8/node_modules/@socketsecurity/lib/dist/smol/detect.js
109
109
  var require_detect = /* @__PURE__ */ __commonJSMin(((exports) => {
110
110
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
111
111
  const require_node_module = require_module();
@@ -178,7 +178,7 @@ var require_detect = /* @__PURE__ */ __commonJSMin(((exports) => {
178
178
  }));
179
179
 
180
180
  //#endregion
181
- //#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/primordials/uncurry.js
181
+ //#region node_modules/.pnpm/@socketsecurity+lib@6.0.8/node_modules/@socketsecurity/lib/dist/primordials/uncurry.js
182
182
  var require_uncurry = /* @__PURE__ */ __commonJSMin(((exports) => {
183
183
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
184
184
  /**
@@ -224,7 +224,88 @@ var require_uncurry = /* @__PURE__ */ __commonJSMin(((exports) => {
224
224
  }));
225
225
 
226
226
  //#endregion
227
- //#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/smol/primordial.js
227
+ //#region node_modules/.pnpm/@socketsecurity+lib@6.0.8/node_modules/@socketsecurity/lib/dist/primordials/object.js
228
+ var require_object = /* @__PURE__ */ __commonJSMin(((exports) => {
229
+ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
230
+ const require_primordials_uncurry = require_uncurry();
231
+ /**
232
+ * @file Safe references to `Object` static methods and prototype methods. Annex
233
+ * B legacy accessor methods (`__defineGetter__`, `__lookupGetter__`, etc.)
234
+ * are exposed alongside the canonical static methods — implementations exist
235
+ * in V8, SpiderMonkey, and JavaScriptCore even though the spec calls them
236
+ * "normative optional".
237
+ */
238
+ const ObjectCtor = Object;
239
+ const ObjectAssign = Object.assign;
240
+ const ObjectCreate = Object.create;
241
+ const ObjectDefineProperties = Object.defineProperties;
242
+ const ObjectDefineProperty = Object.defineProperty;
243
+ const ObjectEntries = Object.entries;
244
+ const ObjectFreeze = Object.freeze;
245
+ const ObjectFromEntries = Object.fromEntries;
246
+ const ObjectGetOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
247
+ const ObjectGetOwnPropertyDescriptors = Object.getOwnPropertyDescriptors;
248
+ const ObjectGetOwnPropertyNames = Object.getOwnPropertyNames;
249
+ const ObjectGetOwnPropertySymbols = Object.getOwnPropertySymbols;
250
+ const ObjectGetPrototypeOf = Object.getPrototypeOf;
251
+ const ObjectHasOwn = Object.hasOwn;
252
+ const ObjectIs = Object.is;
253
+ const ObjectIsExtensible = Object.isExtensible;
254
+ const ObjectIsFrozen = Object.isFrozen;
255
+ const ObjectIsSealed = Object.isSealed;
256
+ const ObjectKeys = Object.keys;
257
+ const ObjectPreventExtensions = Object.preventExtensions;
258
+ const ObjectSeal = Object.seal;
259
+ const ObjectSetPrototypeOf = Object.setPrototypeOf;
260
+ const ObjectValues = Object.values;
261
+ const ObjectPrototype = Object.prototype;
262
+ const ObjectPrototypeHasOwnProperty = require_primordials_uncurry.uncurryThis(Object.prototype.hasOwnProperty);
263
+ const ObjectPrototypeIsPrototypeOf = require_primordials_uncurry.uncurryThis(Object.prototype.isPrototypeOf);
264
+ const ObjectPrototypePropertyIsEnumerable = require_primordials_uncurry.uncurryThis(Object.prototype.propertyIsEnumerable);
265
+ const ObjectPrototypeToString = require_primordials_uncurry.uncurryThis(Object.prototype.toString);
266
+ const ObjectPrototypeValueOf = require_primordials_uncurry.uncurryThis(Object.prototype.valueOf);
267
+ const objectProto = Object.prototype;
268
+ const ObjectPrototypeDefineGetter = require_primordials_uncurry.uncurryThis(objectProto.__defineGetter__);
269
+ const ObjectPrototypeDefineSetter = require_primordials_uncurry.uncurryThis(objectProto.__defineSetter__);
270
+ const ObjectPrototypeLookupGetter = require_primordials_uncurry.uncurryThis(objectProto.__lookupGetter__);
271
+ const ObjectPrototypeLookupSetter = require_primordials_uncurry.uncurryThis(objectProto.__lookupSetter__);
272
+ exports.ObjectAssign = ObjectAssign;
273
+ exports.ObjectCreate = ObjectCreate;
274
+ exports.ObjectCtor = ObjectCtor;
275
+ exports.ObjectDefineProperties = ObjectDefineProperties;
276
+ exports.ObjectDefineProperty = ObjectDefineProperty;
277
+ exports.ObjectEntries = ObjectEntries;
278
+ exports.ObjectFreeze = ObjectFreeze;
279
+ exports.ObjectFromEntries = ObjectFromEntries;
280
+ exports.ObjectGetOwnPropertyDescriptor = ObjectGetOwnPropertyDescriptor;
281
+ exports.ObjectGetOwnPropertyDescriptors = ObjectGetOwnPropertyDescriptors;
282
+ exports.ObjectGetOwnPropertyNames = ObjectGetOwnPropertyNames;
283
+ exports.ObjectGetOwnPropertySymbols = ObjectGetOwnPropertySymbols;
284
+ exports.ObjectGetPrototypeOf = ObjectGetPrototypeOf;
285
+ exports.ObjectHasOwn = ObjectHasOwn;
286
+ exports.ObjectIs = ObjectIs;
287
+ exports.ObjectIsExtensible = ObjectIsExtensible;
288
+ exports.ObjectIsFrozen = ObjectIsFrozen;
289
+ exports.ObjectIsSealed = ObjectIsSealed;
290
+ exports.ObjectKeys = ObjectKeys;
291
+ exports.ObjectPreventExtensions = ObjectPreventExtensions;
292
+ exports.ObjectPrototype = ObjectPrototype;
293
+ exports.ObjectPrototypeDefineGetter = ObjectPrototypeDefineGetter;
294
+ exports.ObjectPrototypeDefineSetter = ObjectPrototypeDefineSetter;
295
+ exports.ObjectPrototypeHasOwnProperty = ObjectPrototypeHasOwnProperty;
296
+ exports.ObjectPrototypeIsPrototypeOf = ObjectPrototypeIsPrototypeOf;
297
+ exports.ObjectPrototypeLookupGetter = ObjectPrototypeLookupGetter;
298
+ exports.ObjectPrototypeLookupSetter = ObjectPrototypeLookupSetter;
299
+ exports.ObjectPrototypePropertyIsEnumerable = ObjectPrototypePropertyIsEnumerable;
300
+ exports.ObjectPrototypeToString = ObjectPrototypeToString;
301
+ exports.ObjectPrototypeValueOf = ObjectPrototypeValueOf;
302
+ exports.ObjectSeal = ObjectSeal;
303
+ exports.ObjectSetPrototypeOf = ObjectSetPrototypeOf;
304
+ exports.ObjectValues = ObjectValues;
305
+ }));
306
+
307
+ //#endregion
308
+ //#region node_modules/.pnpm/@socketsecurity+lib@6.0.8/node_modules/@socketsecurity/lib/dist/smol/primordial.js
228
309
  var require_primordial = /* @__PURE__ */ __commonJSMin(((exports) => {
229
310
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
230
311
  const require_node_module = require_module();
@@ -262,7 +343,7 @@ var require_primordial = /* @__PURE__ */ __commonJSMin(((exports) => {
262
343
  }));
263
344
 
264
345
  //#endregion
265
- //#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/primordials/string.js
346
+ //#region node_modules/.pnpm/@socketsecurity+lib@6.0.8/node_modules/@socketsecurity/lib/dist/primordials/string.js
266
347
  var require_string = /* @__PURE__ */ __commonJSMin(((exports) => {
267
348
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
268
349
  const require_primordials_uncurry = require_uncurry();
@@ -381,92 +462,11 @@ var require_string = /* @__PURE__ */ __commonJSMin(((exports) => {
381
462
  }));
382
463
 
383
464
  //#endregion
384
- //#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/primordials/object.js
385
- var require_object = /* @__PURE__ */ __commonJSMin(((exports) => {
386
- Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
387
- const require_primordials_uncurry = require_uncurry();
388
- /**
389
- * @file Safe references to `Object` static methods and prototype methods. Annex
390
- * B legacy accessor methods (`__defineGetter__`, `__lookupGetter__`, etc.)
391
- * are exposed alongside the canonical static methods — implementations exist
392
- * in V8, SpiderMonkey, and JavaScriptCore even though the spec calls them
393
- * "normative optional".
394
- */
395
- const ObjectCtor = Object;
396
- const ObjectAssign = Object.assign;
397
- const ObjectCreate = Object.create;
398
- const ObjectDefineProperties = Object.defineProperties;
399
- const ObjectDefineProperty = Object.defineProperty;
400
- const ObjectEntries = Object.entries;
401
- const ObjectFreeze = Object.freeze;
402
- const ObjectFromEntries = Object.fromEntries;
403
- const ObjectGetOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
404
- const ObjectGetOwnPropertyDescriptors = Object.getOwnPropertyDescriptors;
405
- const ObjectGetOwnPropertyNames = Object.getOwnPropertyNames;
406
- const ObjectGetOwnPropertySymbols = Object.getOwnPropertySymbols;
407
- const ObjectGetPrototypeOf = Object.getPrototypeOf;
408
- const ObjectHasOwn = Object.hasOwn;
409
- const ObjectIs = Object.is;
410
- const ObjectIsExtensible = Object.isExtensible;
411
- const ObjectIsFrozen = Object.isFrozen;
412
- const ObjectIsSealed = Object.isSealed;
413
- const ObjectKeys = Object.keys;
414
- const ObjectPreventExtensions = Object.preventExtensions;
415
- const ObjectSeal = Object.seal;
416
- const ObjectSetPrototypeOf = Object.setPrototypeOf;
417
- const ObjectValues = Object.values;
418
- const ObjectPrototype = Object.prototype;
419
- const ObjectPrototypeHasOwnProperty = require_primordials_uncurry.uncurryThis(Object.prototype.hasOwnProperty);
420
- const ObjectPrototypeIsPrototypeOf = require_primordials_uncurry.uncurryThis(Object.prototype.isPrototypeOf);
421
- const ObjectPrototypePropertyIsEnumerable = require_primordials_uncurry.uncurryThis(Object.prototype.propertyIsEnumerable);
422
- const ObjectPrototypeToString = require_primordials_uncurry.uncurryThis(Object.prototype.toString);
423
- const ObjectPrototypeValueOf = require_primordials_uncurry.uncurryThis(Object.prototype.valueOf);
424
- const objectProto = Object.prototype;
425
- const ObjectPrototypeDefineGetter = require_primordials_uncurry.uncurryThis(objectProto.__defineGetter__);
426
- const ObjectPrototypeDefineSetter = require_primordials_uncurry.uncurryThis(objectProto.__defineSetter__);
427
- const ObjectPrototypeLookupGetter = require_primordials_uncurry.uncurryThis(objectProto.__lookupGetter__);
428
- const ObjectPrototypeLookupSetter = require_primordials_uncurry.uncurryThis(objectProto.__lookupSetter__);
429
- exports.ObjectAssign = ObjectAssign;
430
- exports.ObjectCreate = ObjectCreate;
431
- exports.ObjectCtor = ObjectCtor;
432
- exports.ObjectDefineProperties = ObjectDefineProperties;
433
- exports.ObjectDefineProperty = ObjectDefineProperty;
434
- exports.ObjectEntries = ObjectEntries;
435
- exports.ObjectFreeze = ObjectFreeze;
436
- exports.ObjectFromEntries = ObjectFromEntries;
437
- exports.ObjectGetOwnPropertyDescriptor = ObjectGetOwnPropertyDescriptor;
438
- exports.ObjectGetOwnPropertyDescriptors = ObjectGetOwnPropertyDescriptors;
439
- exports.ObjectGetOwnPropertyNames = ObjectGetOwnPropertyNames;
440
- exports.ObjectGetOwnPropertySymbols = ObjectGetOwnPropertySymbols;
441
- exports.ObjectGetPrototypeOf = ObjectGetPrototypeOf;
442
- exports.ObjectHasOwn = ObjectHasOwn;
443
- exports.ObjectIs = ObjectIs;
444
- exports.ObjectIsExtensible = ObjectIsExtensible;
445
- exports.ObjectIsFrozen = ObjectIsFrozen;
446
- exports.ObjectIsSealed = ObjectIsSealed;
447
- exports.ObjectKeys = ObjectKeys;
448
- exports.ObjectPreventExtensions = ObjectPreventExtensions;
449
- exports.ObjectPrototype = ObjectPrototype;
450
- exports.ObjectPrototypeDefineGetter = ObjectPrototypeDefineGetter;
451
- exports.ObjectPrototypeDefineSetter = ObjectPrototypeDefineSetter;
452
- exports.ObjectPrototypeHasOwnProperty = ObjectPrototypeHasOwnProperty;
453
- exports.ObjectPrototypeIsPrototypeOf = ObjectPrototypeIsPrototypeOf;
454
- exports.ObjectPrototypeLookupGetter = ObjectPrototypeLookupGetter;
455
- exports.ObjectPrototypeLookupSetter = ObjectPrototypeLookupSetter;
456
- exports.ObjectPrototypePropertyIsEnumerable = ObjectPrototypePropertyIsEnumerable;
457
- exports.ObjectPrototypeToString = ObjectPrototypeToString;
458
- exports.ObjectPrototypeValueOf = ObjectPrototypeValueOf;
459
- exports.ObjectSeal = ObjectSeal;
460
- exports.ObjectSetPrototypeOf = ObjectSetPrototypeOf;
461
- exports.ObjectValues = ObjectValues;
462
- }));
463
-
464
- //#endregion
465
- //#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/errors/predicates.js
465
+ //#region node_modules/.pnpm/@socketsecurity+lib@6.0.8/node_modules/@socketsecurity/lib/dist/errors/predicates.js
466
466
  var require_predicates = /* @__PURE__ */ __commonJSMin(((exports) => {
467
467
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
468
- const require_primordials_string = require_string();
469
468
  const require_primordials_object = require_object();
469
+ const require_primordials_string = require_string();
470
470
  /**
471
471
  * @file Error type-guard predicates — `isError` (with the `isErrorBuiltin` /
472
472
  * `isErrorShim` building blocks) and the libuv errno-code narrower
@@ -529,7 +529,7 @@ var require_predicates = /* @__PURE__ */ __commonJSMin(((exports) => {
529
529
  }));
530
530
 
531
531
  //#endregion
532
- //#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/primordials/map-set.js
532
+ //#region node_modules/.pnpm/@socketsecurity+lib@6.0.8/node_modules/@socketsecurity/lib/dist/primordials/map-set.js
533
533
  var require_map_set = /* @__PURE__ */ __commonJSMin(((exports) => {
534
534
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
535
535
  const require_primordials_uncurry = require_uncurry();
@@ -622,7 +622,7 @@ var require_map_set = /* @__PURE__ */ __commonJSMin(((exports) => {
622
622
  }));
623
623
 
624
624
  //#endregion
625
- //#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/external/pony-cause.js
625
+ //#region node_modules/.pnpm/@socketsecurity+lib@6.0.8/node_modules/@socketsecurity/lib/dist/external/pony-cause.js
626
626
  var require_pony_cause$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
627
627
  const { SetCtor: _p_SetCtor } = require_map_set();
628
628
  var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
@@ -751,7 +751,7 @@ var require_pony_cause$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
751
751
  }));
752
752
 
753
753
  //#endregion
754
- //#region node_modules/.pnpm/@socketsecurity+lib@6.0.7/node_modules/@socketsecurity/lib/dist/errors/message.js
754
+ //#region node_modules/.pnpm/@socketsecurity+lib@6.0.8/node_modules/@socketsecurity/lib/dist/errors/message.js
755
755
  var require_message = /* @__PURE__ */ __commonJSMin(((exports) => {
756
756
  Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
757
757
  const require_constants_sentinels = require_sentinels();
package/package.json CHANGED
@@ -1,8 +1,12 @@
1
1
  {
2
2
  "name": "@socketsecurity/mcp",
3
- "version": "0.0.18",
3
+ "version": "0.0.19",
4
4
  "description": "Socket MCP server for scanning dependencies",
5
5
  "keywords": [],
6
+ "homepage": "https://github.com/SocketDev/socket-mcp#readme",
7
+ "bugs": {
8
+ "url": "https://github.com/SocketDev/socket-mcp/issues"
9
+ },
6
10
  "author": "Alexandros Kapravelos",
7
11
  "repository": {
8
12
  "type": "git",
@@ -14,7 +18,6 @@
14
18
  "files": [
15
19
  "CHANGELOG.md",
16
20
  "dist/index.cjs",
17
- "dist/index.d.ts",
18
21
  "hooks/socket-gate",
19
22
  "package.json"
20
23
  ],
@@ -31,23 +34,24 @@
31
34
  "@sinclair/typebox": "0.34.49",
32
35
  "@socketregistry/packageurl-js": "1.4.2",
33
36
  "@socketregistry/packageurl-js-stable": "npm:@socketregistry/packageurl-js@1.4.2",
34
- "@socketsecurity/lib": "npm:@socketsecurity/lib@6.0.7",
35
- "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@6.0.7",
37
+ "@socketsecurity/lib": "6.0.8",
38
+ "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@6.0.8",
36
39
  "@socketsecurity/sdk": "4.0.1",
37
40
  "@socketsecurity/sdk-stable": "npm:@socketsecurity/sdk@4.0.1",
38
- "@types/node": "^24.12.4",
41
+ "@types/node": "^24.13.1",
39
42
  "@types/shell-quote": "1.7.5",
40
43
  "@typescript/native-preview": "7.0.0-dev.20260510.1",
41
- "@vitest/coverage-v8": "4.1.6",
44
+ "@vitest/coverage-v8": "4.1.8",
42
45
  "nock": "14.0.15",
43
46
  "npm-run-all2": "^8.0.4",
44
47
  "oxfmt": "0.48.0",
45
48
  "oxlint": "1.63.0",
46
- "rolldown": "1.0.3",
49
+ "regjsparser": "0.13.1",
50
+ "rolldown": "1.1.0",
47
51
  "shell-quote": "1.8.4",
48
- "taze": "19.11.0",
52
+ "taze": "19.14.1",
49
53
  "untracked": "1.6.1",
50
- "vitest": "4.1.6"
54
+ "vitest": "4.1.8"
51
55
  },
52
56
  "engines": {
53
57
  "node": ">=22.0.0",
@@ -78,7 +82,6 @@
78
82
  "update": "node scripts/fleet/update.mts",
79
83
  "build": "npm run clean && run-s build:*",
80
84
  "build:bundle": "node scripts/build.mts",
81
- "build:types": "tsgo -p tsconfig.dts.json",
82
85
  "build:permissions": "chmod +x ./dist/index.cjs",
83
86
  "build-mcpb": "run-s build build-mcpb:*",
84
87
  "build-mcpb:versions_match": "node scripts/check-versions.ts",
@@ -93,11 +96,13 @@
93
96
  "server-stdio:debug": "SOCKET_DEBUG=1 SOCKET_API_TOKEN=${SOCKET_API_TOKEN:-${SOCKET_API_KEY}} node ./index.ts",
94
97
  "server-http": "MCP_HTTP_MODE=true SOCKET_API_TOKEN=${SOCKET_API_TOKEN:-${SOCKET_API_KEY}} node ./index.ts",
95
98
  "server-http:debug": "SOCKET_DEBUG=1 MCP_HTTP_MODE=true SOCKET_API_TOKEN=${SOCKET_API_TOKEN:-${SOCKET_API_KEY}} node ./index.ts",
96
- "check:paths": "node scripts/fleet/check-paths.mts",
99
+ "check:paths": "node scripts/fleet/check/paths-are-canonical.mts",
97
100
  "security": "node scripts/fleet/security.mts",
98
101
  "setup-security-tools": "node .claude/hooks/fleet/setup-security-tools/install.mts",
99
102
  "lockstep": "node scripts/fleet/lockstep.mts",
100
103
  "lockstep:emit-schema": "node scripts/fleet/lockstep-emit-schema.mts",
101
- "ci:local": "agent-ci run --all"
104
+ "ci:local": "node scripts/fleet/agent-ci-skip-locks.mts run --all --quiet --pause-on-failure --github-token",
105
+ "weekly-update": "node scripts/fleet/weekly-update.mts",
106
+ "weekly-update:ci": "node scripts/fleet/weekly-update-workflow.mts run"
102
107
  }
103
108
  }
package/dist/index.d.ts DELETED
@@ -1,4 +0,0 @@
1
- #!/usr/bin/env node
2
- export { buildSocketHeaders, getApiKeyInteractively, getForwardedHeaderValue, getRequestBaseUrl, getRequestHeaderValue, parseJsonObject, writeJson, writeOAuthError, } from './lib/http-helpers.ts';
3
- export { createConfiguredServer } from './lib/server.ts';
4
- export { authenticateRequest, buildProtectedResourceMetadata, getProtectedResourceMetadataUrl, loadOAuthMetadata, splitScopes, verifyAccessToken, } from './lib/oauth.ts';