@viberaven/mcp 1.4.4 → 1.5.1

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 VibeRaven
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 VibeRaven
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,69 +1,69 @@
-# @viberaven/mcp
-
-[![npm version](https://img.shields.io/npm/v/@viberaven/mcp)](https://www.npmjs.com/package/@viberaven/mcp)
-[![npm downloads](https://img.shields.io/npm/dw/@viberaven/mcp)](https://www.npmjs.com/package/@viberaven/mcp)
-[![license](https://img.shields.io/npm/l/@viberaven/mcp)](https://www.npmjs.com/package/@viberaven/mcp)
-
-Thin MCP wrapper for VibeRaven.
-
-This package exposes VibeRaven CLI actions as MCP tools for Codex, Claude Code, Cursor, and other agent runtimes. It does not contain VibeRaven backend logic and does not bypass VibeRaven login or scan quotas.
-
-The MCP server wraps the stable CLI package: `npx -y viberaven`.
-
-For agent-mode artifacts, use `npx -y viberaven --agent-mode`.
-
-## Run
-
-```bash
-npx -y @viberaven/mcp
-```
-
-You can also start the MCP server from the main CLI package:
-
-```bash
-npx -y viberaven mcp
-```
-
-## Tools
-
-- `viberaven_check_readiness` -> `npx -y viberaven check --json`
-- `viberaven_verify` -> `npx -y viberaven check --json`
-- `viberaven_audit` -> `npx -y viberaven audit --vercel-supabase`
-- `viberaven_init_rules` -> `npx -y viberaven init`
-- `viberaven_clean_plan` -> `npx -y viberaven clean --plan`
-- `viberaven_strict_gate` -> `npx -y viberaven --strict --json`
-- `viberaven_gate_result` -> `npx -y viberaven --json`
-- `viberaven_context_map` -> `npx -y viberaven --condense`
-- `viberaven_actions` -> `npx -y viberaven actions`
-- `viberaven_verify_action` -> `npx -y viberaven verify --action <id>`
-- `viberaven_heal_plan` -> `npx -y viberaven --heal --plan`
-- `viberaven_heal_prompt` -> `npx -y viberaven --heal --prompt`
-- `viberaven_heal_apply` -> `npx -y viberaven --heal --apply`
-- `viberaven_validate_npm_package` -> `npx -y viberaven validate-npm-package --json`
-
-`viberaven_check_readiness` is the canonical entrypoint. It runs the local `viberaven check` (no login, no API key, no telemetry) and writes `.viberaven/agent-tasklist.md`, `.viberaven/gate-result.json`, and `.viberaven/context-map.json`.
-
-After a batch of fixes, call `viberaven_verify`. Before deploy or CI pass, call `viberaven_strict_gate` or run:
-
-```bash
-npx -y viberaven --strict
-```
-
-## Machine Artifact Contract
-
-```text
-docs/contracts/artifacts.md
-https://viberaven.dev/schemas/gate-result.schema.json
-https://viberaven.dev/schemas/context-map.schema.json
-https://viberaven.dev/schemas/gap.schema.json
-https://viberaven.dev/schemas/heal-result.schema.json
-```
-
-## Login
-
-If VibeRaven prints `LOGIN_URL_READY`, open that exact URL for the user, keep the MCP call alive, and do not ask for passwords, tokens, cookies, or other secrets.
-
-## Security
-
-The MCP package is public integration glue only. It returns CLI stdout/stderr and structured JSON content when available. It does not mutate provider dashboards and does not bypass VibeRaven login, managed API checks, or quota enforcement. Do not claim provider dashboard checks are fixed by repo-code edits.
-
+# @viberaven/mcp
+
+[![npm version](https://img.shields.io/npm/v/@viberaven/mcp)](https://www.npmjs.com/package/@viberaven/mcp)
+[![npm downloads](https://img.shields.io/npm/dw/@viberaven/mcp)](https://www.npmjs.com/package/@viberaven/mcp)
+[![license](https://img.shields.io/npm/l/@viberaven/mcp)](https://www.npmjs.com/package/@viberaven/mcp)
+
+Thin MCP wrapper for VibeRaven.
+
+This package exposes VibeRaven CLI actions as MCP tools for Codex, Claude Code, Cursor, and other agent runtimes. It does not contain VibeRaven backend logic and does not bypass VibeRaven login or scan quotas.
+
+The MCP server wraps the stable CLI package: `npx -y viberaven`.
+
+For agent-mode artifacts, use `npx -y viberaven --agent-mode`.
+
+## Run
+
+```bash
+npx -y @viberaven/mcp
+```
+
+You can also start the MCP server from the main CLI package:
+
+```bash
+npx -y viberaven mcp
+```
+
+## Tools
+
+- `viberaven_check_readiness` -> `npx -y viberaven check --json`
+- `viberaven_verify` -> `npx -y viberaven check --json`
+- `viberaven_audit` -> `npx -y viberaven audit --vercel-supabase`
+- `viberaven_init_rules` -> `npx -y viberaven init`
+- `viberaven_clean_plan` -> `npx -y viberaven clean --plan`
+- `viberaven_strict_gate` -> `npx -y viberaven --strict --json`
+- `viberaven_gate_result` -> `npx -y viberaven --json`
+- `viberaven_context_map` -> `npx -y viberaven --condense`
+- `viberaven_actions` -> `npx -y viberaven actions`
+- `viberaven_verify_action` -> `npx -y viberaven verify --action <id>`
+- `viberaven_heal_plan` -> `npx -y viberaven --heal --plan`
+- `viberaven_heal_prompt` -> `npx -y viberaven --heal --prompt`
+- `viberaven_heal_apply` -> `npx -y viberaven --heal --apply`
+- `viberaven_validate_npm_package` -> `npx -y viberaven validate-npm-package --json`
+
+`viberaven_check_readiness` is the canonical entrypoint. It runs the local `viberaven check` (no login, no API key, no telemetry) and writes `.viberaven/agent-tasklist.md`, `.viberaven/gate-result.json`, and `.viberaven/context-map.json`.
+
+After a batch of fixes, call `viberaven_verify`. Before deploy or CI pass, call `viberaven_strict_gate` or run:
+
+```bash
+npx -y viberaven --strict
+```
+
+## Machine Artifact Contract
+
+```text
+docs/contracts/artifacts.md
+https://viberaven.dev/schemas/gate-result.schema.json
+https://viberaven.dev/schemas/context-map.schema.json
+https://viberaven.dev/schemas/gap.schema.json
+https://viberaven.dev/schemas/heal-result.schema.json
+```
+
+## Login
+
+If VibeRaven prints `LOGIN_URL_READY`, open that exact URL for the user, keep the MCP call alive, and do not ask for passwords, tokens, cookies, or other secrets.
+
+## Security
+
+The MCP package is public integration glue only. It returns CLI stdout/stderr and structured JSON content when available. It does not mutate provider dashboards and does not bypass VibeRaven login, managed API checks, or quota enforcement. Do not claim provider dashboard checks are fixed by repo-code edits.
+

package/dist/lib/cli-runner.js

@@ -26,13 +26,57 @@ __export(cli_runner_exports, {
   buildHealArgs: () => buildHealArgs,
   buildNpxCommand: () => buildNpxCommand,
   buildToolArgs: () => buildToolArgs,
+  cliChildEnv: () => cliChildEnv,
+  cliNpxArgs: () => cliNpxArgs,
+  cliPackageSpec: () => cliPackageSpec,
+  mcpVersion: () => mcpVersion,
   resolveCwd: () => resolveCwd,
   runVibeRaven: () => runVibeRaven,
   safeStringArg: () => safeStringArg
 });
 module.exports = __toCommonJS(cli_runner_exports);
 var import_node_child_process = require("node:child_process");
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
 var CLI_PACKAGE = "@viberaven/cli";
+var MCP_PACKAGE = "@viberaven/mcp";
+var PLAIN_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+var cachedVersion;
+function mcpVersion() {
+  if (cachedVersion) return cachedVersion;
+  let found;
+  for (let dir = __dirname, depth = 0; depth < 4 && !found; depth += 1, dir = (0, import_node_path.dirname)(dir)) {
+    try {
+      const manifest = JSON.parse((0, import_node_fs.readFileSync)((0, import_node_path.join)(dir, "package.json"), "utf8"));
+      if (manifest.name === MCP_PACKAGE && typeof manifest.version === "string") found = manifest.version;
+    } catch {
+    }
+  }
+  found ??= true ? "1.5.1" : void 0;
+  if (!found || !PLAIN_VERSION.test(found)) {
+    throw new Error(`Could not read a valid ${MCP_PACKAGE} version (got ${JSON.stringify(found)}), so the matching ${CLI_PACKAGE} cannot be pinned.`);
+  }
+  cachedVersion = found;
+  return found;
+}
+function cliPackageSpec() {
+  return `${CLI_PACKAGE}@${mcpVersion()}`;
+}
+var CLI_BIN = "viberaven";
+function cliNpxArgs(args) {
+  return ["-y", `--package=${cliPackageSpec()}`, "--", CLI_BIN, ...args];
+}
+var KEPT_NPM_CONFIG = /^(?:registry|.+:registry|proxy|https?_proxy|no_?proxy|cafile|ca|cert|key|strict_ssl|cache|offline|prefer_offline|prefer_online|fetch_.+|maxsockets|always_auth|_auth|_authtoken|.+:_auth|.+:_authtoken)$/;
+function cliChildEnv(env = process.env) {
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    const lower = key.toLowerCase();
+    if (lower.startsWith("npm_package_") || lower.startsWith("npm_lifecycle_")) continue;
+    if (lower.startsWith("npm_config_") && !KEPT_NPM_CONFIG.test(lower.slice("npm_config_".length))) continue;
+    out[key] = value;
+  }
+  return out;
+}
 var spawnFn = import_node_child_process.spawn;
 function __setSpawnForTest(fn) {
   spawnFn = fn;
@@ -113,11 +157,17 @@ function buildToolArgs(name, args) {
   }
 }
 function runVibeRaven(args, cwd) {
+  let npxArgs;
+  try {
+    npxArgs = cliNpxArgs(args);
+  } catch (error) {
+    return Promise.resolve(`ERROR: ${error instanceof Error ? error.message : String(error)}`);
+  }
   return new Promise((resolve) => {
-    const built = buildNpxCommand(["-y", CLI_PACKAGE, ...args]);
+    const built = buildNpxCommand(npxArgs);
     const child = spawnFn(built.command, built.args, {
       cwd: resolveCwd(cwd),
-      env: process.env,
+      env: cliChildEnv(),
       shell: built.shell,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -144,6 +194,10 @@ ${combined}` : ""}`);
   buildHealArgs,
   buildNpxCommand,
   buildToolArgs,
+  cliChildEnv,
+  cliNpxArgs,
+  cliPackageSpec,
+  mcpVersion,
   resolveCwd,
   runVibeRaven,
   safeStringArg

package/dist/server.js

@@ -175,7 +175,47 @@ var npmTools = [
 
 // src/lib/cli-runner.ts
 var import_node_child_process = require("node:child_process");
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
 var CLI_PACKAGE = "@viberaven/cli";
+var MCP_PACKAGE = "@viberaven/mcp";
+var PLAIN_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+var cachedVersion;
+function mcpVersion() {
+  if (cachedVersion) return cachedVersion;
+  let found;
+  for (let dir = __dirname, depth = 0; depth < 4 && !found; depth += 1, dir = (0, import_node_path.dirname)(dir)) {
+    try {
+      const manifest = JSON.parse((0, import_node_fs.readFileSync)((0, import_node_path.join)(dir, "package.json"), "utf8"));
+      if (manifest.name === MCP_PACKAGE && typeof manifest.version === "string") found = manifest.version;
+    } catch {
+    }
+  }
+  found ??= true ? "1.5.1" : void 0;
+  if (!found || !PLAIN_VERSION.test(found)) {
+    throw new Error(`Could not read a valid ${MCP_PACKAGE} version (got ${JSON.stringify(found)}), so the matching ${CLI_PACKAGE} cannot be pinned.`);
+  }
+  cachedVersion = found;
+  return found;
+}
+function cliPackageSpec() {
+  return `${CLI_PACKAGE}@${mcpVersion()}`;
+}
+var CLI_BIN = "viberaven";
+function cliNpxArgs(args) {
+  return ["-y", `--package=${cliPackageSpec()}`, "--", CLI_BIN, ...args];
+}
+var KEPT_NPM_CONFIG = /^(?:registry|.+:registry|proxy|https?_proxy|no_?proxy|cafile|ca|cert|key|strict_ssl|cache|offline|prefer_offline|prefer_online|fetch_.+|maxsockets|always_auth|_auth|_authtoken|.+:_auth|.+:_authtoken)$/;
+function cliChildEnv(env = process.env) {
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    const lower = key.toLowerCase();
+    if (lower.startsWith("npm_package_") || lower.startsWith("npm_lifecycle_")) continue;
+    if (lower.startsWith("npm_config_") && !KEPT_NPM_CONFIG.test(lower.slice("npm_config_".length))) continue;
+    out[key] = value;
+  }
+  return out;
+}
 var spawnFn = import_node_child_process.spawn;
 function safeStringArg(value, label) {
   if (typeof value !== "string") throw new Error(`Invalid ${label}: expected string`);
@@ -250,11 +290,17 @@ function buildToolArgs(name, args) {
   }
 }
 function runVibeRaven(args, cwd) {
+  let npxArgs;
+  try {
+    npxArgs = cliNpxArgs(args);
+  } catch (error) {
+    return Promise.resolve(`ERROR: ${error instanceof Error ? error.message : String(error)}`);
+  }
   return new Promise((resolve) => {
-    const built = buildNpxCommand(["-y", CLI_PACKAGE, ...args]);
+    const built = buildNpxCommand(npxArgs);
     const child = spawnFn(built.command, built.args, {
       cwd: resolveCwd(cwd),
-      env: process.env,
+      env: cliChildEnv(),
       shell: built.shell,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -315,7 +361,7 @@ async function handleRequest(method, params) {
 }
 
 // src/server.ts
-var SERVER_INFO = { name: "viberaven-mcp", version: "1.4.4" };
+var SERVER_INFO = { name: "viberaven-mcp", version: "1.5.1" };
 var server = new import_server.Server(SERVER_INFO, { capabilities: { tools: {} } });
 server.setRequestHandler(
   import_types.ListToolsRequestSchema,

package/dist/tools/index.js

@@ -176,7 +176,47 @@ var npmTools = [
 
 // src/lib/cli-runner.ts
 var import_node_child_process = require("node:child_process");
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
 var CLI_PACKAGE = "@viberaven/cli";
+var MCP_PACKAGE = "@viberaven/mcp";
+var PLAIN_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+var cachedVersion;
+function mcpVersion() {
+  if (cachedVersion) return cachedVersion;
+  let found;
+  for (let dir = __dirname, depth = 0; depth < 4 && !found; depth += 1, dir = (0, import_node_path.dirname)(dir)) {
+    try {
+      const manifest = JSON.parse((0, import_node_fs.readFileSync)((0, import_node_path.join)(dir, "package.json"), "utf8"));
+      if (manifest.name === MCP_PACKAGE && typeof manifest.version === "string") found = manifest.version;
+    } catch {
+    }
+  }
+  found ??= true ? "1.5.1" : void 0;
+  if (!found || !PLAIN_VERSION.test(found)) {
+    throw new Error(`Could not read a valid ${MCP_PACKAGE} version (got ${JSON.stringify(found)}), so the matching ${CLI_PACKAGE} cannot be pinned.`);
+  }
+  cachedVersion = found;
+  return found;
+}
+function cliPackageSpec() {
+  return `${CLI_PACKAGE}@${mcpVersion()}`;
+}
+var CLI_BIN = "viberaven";
+function cliNpxArgs(args) {
+  return ["-y", `--package=${cliPackageSpec()}`, "--", CLI_BIN, ...args];
+}
+var KEPT_NPM_CONFIG = /^(?:registry|.+:registry|proxy|https?_proxy|no_?proxy|cafile|ca|cert|key|strict_ssl|cache|offline|prefer_offline|prefer_online|fetch_.+|maxsockets|always_auth|_auth|_authtoken|.+:_auth|.+:_authtoken)$/;
+function cliChildEnv(env = process.env) {
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    const lower = key.toLowerCase();
+    if (lower.startsWith("npm_package_") || lower.startsWith("npm_lifecycle_")) continue;
+    if (lower.startsWith("npm_config_") && !KEPT_NPM_CONFIG.test(lower.slice("npm_config_".length))) continue;
+    out[key] = value;
+  }
+  return out;
+}
 var spawnFn = import_node_child_process.spawn;
 function __setSpawnForTest(fn) {
   spawnFn = fn;
@@ -257,11 +297,17 @@ function buildToolArgs(name, args) {
   }
 }
 function runVibeRaven(args, cwd) {
+  let npxArgs;
+  try {
+    npxArgs = cliNpxArgs(args);
+  } catch (error) {
+    return Promise.resolve(`ERROR: ${error instanceof Error ? error.message : String(error)}`);
+  }
   return new Promise((resolve) => {
-    const built = buildNpxCommand(["-y", CLI_PACKAGE, ...args]);
+    const built = buildNpxCommand(npxArgs);
     const child = spawnFn(built.command, built.args, {
       cwd: resolveCwd(cwd),
-      env: process.env,
+      env: cliChildEnv(),
       shell: built.shell,
       stdio: ["ignore", "pipe", "pipe"]
     });

package/package.json

@@ -1,56 +1,56 @@
-{
-  "name": "@viberaven/mcp",
-  "version": "1.4.4",
-  "description": "MCP server for VibeRaven production-readiness: check_readiness, verify, heal, audit, and strict gate tools for Cursor, Claude Code, and Codex.",
-  "license": "MIT",
-  "author": "VibeRaven",
-  "mcpName": "io.github.ohad6k/viberaven",
-  "homepage": "https://viberaven.dev/mcp.md",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/ohad6k/VibeRaven.git",
-    "directory": "packages/mcp"
-  },
-  "bugs": {
-    "url": "https://github.com/ohad6k/VibeRaven/issues"
-  },
-  "keywords": [
-    "viberaven",
-    "mcp",
-    "claude-code",
-    "codex",
-    "cursor",
-    "launch-readiness",
-    "production"
-  ],
-  "publishConfig": {
-    "access": "public",
-    "tag": "latest"
-  },
-  "bin": {
-    "viberaven-mcp": "dist/server.js"
-  },
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "engines": {
-    "node": ">=20"
-  },
-  "scripts": {
-    "build": "node scripts/build.mjs",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "presmoke": "npm run build",
-    "smoke": "node scripts/smoke.mjs",
-    "pretest": "npm run build",
-    "test": "vitest run"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0"
-  },
-  "devDependencies": {
-    "esbuild": "^0.25.0",
-    "typescript": "^5.8.0",
-    "vitest": "^3.2.0"
-  }
-}
+{
+  "name": "@viberaven/mcp",
+  "version": "1.5.1",
+  "description": "MCP server for VibeRaven production-readiness: check_readiness, verify, heal, audit, and strict gate tools for Cursor, Claude Code, and Codex.",
+  "license": "MIT",
+  "author": "VibeRaven",
+  "mcpName": "io.github.ohad6k/viberaven",
+  "homepage": "https://viberaven.dev/mcp.md",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ohad6k/VibeRaven.git",
+    "directory": "packages/mcp"
+  },
+  "bugs": {
+    "url": "https://github.com/ohad6k/VibeRaven/issues"
+  },
+  "keywords": [
+    "viberaven",
+    "mcp",
+    "claude-code",
+    "codex",
+    "cursor",
+    "launch-readiness",
+    "production"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  },
+  "bin": {
+    "viberaven-mcp": "dist/server.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "presmoke": "npm run build",
+    "smoke": "node scripts/smoke.mjs",
+    "pretest": "npm run build",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0"
+  },
+  "devDependencies": {
+    "esbuild": "^0.25.0",
+    "typescript": "^5.8.0",
+    "vitest": "^3.2.0"
+  }
+}