@yawlabs/npmjs-mcp 0.11.11 → 0.11.12

package/dist/index.js

@@ -31469,9 +31469,13 @@ var analysisTools = [
         if (latest) auditMap[name] = [latest];
       }
       let auditData = {};
+      let auditSucceeded = false;
       if (Object.keys(auditMap).length > 0) {
         const auditRes = await registryPost("/-/npm/v1/security/advisories/bulk", auditMap);
-        if (auditRes.ok && auditRes.data) auditData = auditRes.data;
+        if (auditRes.ok && auditRes.data) {
+          auditData = auditRes.data;
+          auditSucceeded = true;
+        }
       }
       const results = partials.map(({ name, pkgRes, dlRes }) => {
         if (!pkgRes.ok) {
@@ -31482,8 +31486,9 @@ var analysisTools = [
         const latest = pkg["dist-tags"]?.latest;
         const latestVersion = latest ? pkg.versions[latest] : void 0;
         const versionKeys = Object.keys(pkg.versions);
+        const wasAudited = auditSucceeded && name in auditMap;
         const advisories = auditData[name];
-        const vulnerabilities = Array.isArray(advisories) ? advisories.length : 0;
+        const vulnerabilities = wasAudited ? Array.isArray(advisories) ? advisories.length : 0 : null;
         return {
           name,
           description: pkg.description,
@@ -31498,7 +31503,8 @@ var analysisTools = [
           hasReadme: !!(pkg.readme && pkg.readme.length > 0),
           repository: pkg.repository,
           homepage: pkg.homepage,
-          vulnerabilities
+          vulnerabilities,
+          auditReliable: wasAudited
         };
       });
       return { ok: true, status: 200, data: { comparison: results } };
@@ -31586,8 +31592,11 @@ var analysisTools = [
           // Holistic single-string verdict layered priority-first: a deprecated
           // package supersedes everything (don't use it), a vulnerable package
           // supersedes maintenance signals (active development doesn't undo a
-          // CVE), then staleness, recency, and the catch-all.
-          assessment: isDeprecated ? "DEPRECATED" : vulnerabilityCount !== null && vulnerabilityCount > 0 ? "VULNERABLE" : isStale ? "STALE" : daysSinceLastPublish !== null && daysSinceLastPublish < 90 ? "ACTIVE" : "MAINTENANCE"
+          // CVE), then AUDIT_UNKNOWN when we couldn't verify vuln status (a 5xx
+          // on the audit endpoint or a packument with no `latest` to audit) --
+          // better to flag the unknown than confidently report ACTIVE on
+          // unverified data. Then staleness, recency, and the catch-all.
+          assessment: isDeprecated ? "DEPRECATED" : vulnerabilityCount !== null && vulnerabilityCount > 0 ? "VULNERABLE" : !auditReliable ? "AUDIT_UNKNOWN" : isStale ? "STALE" : daysSinceLastPublish !== null && daysSinceLastPublish < 90 ? "ACTIVE" : "MAINTENANCE"
         }
       };
     }
@@ -31951,7 +31960,10 @@ var dependencyTools = [
         if (tree[resolvedKey]) return;
         const versionData = pkg.versions[resolvedVersion];
         if (!versionData) {
-          tree[resolvedKey] = { version: resolvedVersion, dependencies: {}, failed: true };
+          if (!failedPackages.has(name)) {
+            failedPackages.add(name);
+            tree[resolvedKey] = { version: resolvedVersion, dependencies: {}, failed: true };
+          }
           return;
         }
         const deps = versionData.dependencies ?? {};
@@ -34235,7 +34247,7 @@ var writeTools = [
 ];
 
 // src/index.ts
-var version2 = true ? "0.11.11" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.11.12" : (await null).createRequire(import.meta.url)("../package.json").version;
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version" || subcommand === "-v" || subcommand === "-V") {
   console.log(version2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/npmjs-mcp",
-  "version": "0.11.11",
+  "version": "0.11.12",
   "mcpName": "io.github.YawLabs/npmjs-mcp",
   "description": "npm registry MCP server — package intelligence, security audits, and dependency analysis for AI assistants",
   "license": "MIT",