efaimo 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -4,6 +4,53 @@ All notable changes to efaimo are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project uses
 [Semantic Versioning](https://semver.org/).
 
+## [0.5.0] - 2026-09-04
+
+### Changed
+
+- **`efaimo mcp` is built on the 2.x SDK line and now satisfies the
+  specification this tool audits other servers against.** The 1.x line speaks
+  2025-11-25; it cannot answer `server/discover` and cannot carry the SEP-2549
+  cache fields, so the one MCP server this project ships failed two MUST-level
+  items of the 2026-07-28 revision, and `check --mcp` said so about it on every
+  run. The skill this project publishes about that migration opens with "upgrade
+  the SDK first". This is that.
+
+  Measured against the built server, before and after, with the same command:
+
+  ```
+  before   2026-07-28 readiness  3 items to migrate   E106, E118, E107
+  after    2026-07-28 readiness  clean, nothing to migrate
+  ```
+
+  Read off the wire rather than from our own tool as well: a modern opening now
+  answers `server/discover` with `supportedVersions`, `capabilities`,
+  `resultType: "complete"`, `ttlMs` and `cacheScope`, and `tools/list` carries
+  the same three fields. A 2025-era client that opens with `initialize` is still
+  served, unchanged, because `serveStdio` pins the era per connection rather
+  than making the server pick one.
+
+- **The client half moved with it**, from `@modelcontextprotocol/sdk` to
+  `@modelcontextprotocol/client`. Doing only the server half would have left
+  both generations installed, and E101 stops firing the moment any 2.x package
+  is present, so the half-migration would have silenced the rule that was
+  telling the truth.
+
+### Fixed
+
+- **Two moderate advisories, by subtraction.** `qs` arrived through
+  `body-parser` through `express` through the 1.x SDK, which pulls a whole HTTP
+  and OAuth stack that a stdio server never speaks. `pnpm audit --prod` now
+  reports no known vulnerabilities, and production dependencies went from 30 to
+  13.
+
+### Notes
+
+- No rule changed, so no grade moved. `rulesVersion` is untouched and the
+  published skills index does not need regenerating.
+- `check --skill`, `weigh`, `find` and `test` are byte-identical in behaviour;
+  the only thing that moved is what `efaimo mcp` puts on the wire.
+
 ## [0.4.0] - 2026-09-03
 
 ### Fixed
@@ -408,6 +455,7 @@ First release.
   Documented rule set (`docs/RULES.md`), token methodology (`docs/METHODOLOGY.md`),
   and integration guide (`docs/INTEGRATIONS.md`).
 
+[0.5.0]: https://github.com/efaimo-ai/efaimo/releases/tag/v0.5.0
 [0.4.0]: https://github.com/efaimo-ai/efaimo/releases/tag/v0.4.0
 [0.3.0]: https://github.com/efaimo-ai/efaimo/releases/tag/v0.3.0
 [0.2.0]: https://github.com/efaimo-ai/efaimo/releases/tag/v0.2.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: efaimo
 description: Audit MCP servers and Agent Skills for quality and context-window cost. Use when the user wants to check an MCP server's token cost, lint a skill, verify 2026-07-28 MCP spec readiness, find out whether a search can single out a server's tools under deferred tool loading, or add an efaimo badge or CI gate.
 license: Apache-2.0
 metadata:
-  version: "0.4.0"
+  version: "0.5.0"
   homepage: "https://efaimo.ai"
 ---
 

package/dist/clients/introspect.js

@@ -1,8 +1,8 @@
 import crossSpawn from "cross-spawn";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { Client } from "@modelcontextprotocol/client";
+import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
+import { SSEClientTransport } from "@modelcontextprotocol/client";
 import { introspectStateless } from "./stateless.js";
 import { minimalChildEnv } from "../util/childEnv.js";
 import { truncate, withTimeout } from "../util/misc.js";

package/dist/mcp/server.d.ts

@@ -1,3 +1,3 @@
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-export declare function buildMcpServer(): Server;
+import { McpServer } from "@modelcontextprotocol/server";
+export declare function buildMcpServer(): McpServer;
 export declare function runMcpServer(): Promise<void>;

package/dist/mcp/server.js

@@ -1,88 +1,94 @@
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { McpServer } from "@modelcontextprotocol/server";
+import { serveStdio } from "@modelcontextprotocol/server/stdio";
+import { z } from "zod";
 import { checkSkillSet } from "../check/check.js";
 import { weighSkills } from "../weigh/weigh.js";
 import { findSkills } from "../skills/parse.js";
 import { renderCheckMarkdown, renderSkillSetMarkdown, renderWeighMarkdown } from "../reporters/markdown.js";
 import { VERSION } from "../version.js";
+/**
+ * `efaimo mcp`: a small, read-only MCP server that exposes the skill checks to an
+ * agent, so it can lint or weigh a skill mid-session before committing it to
+ * context. Deliberately narrow: the tools only read files. They spawn no process
+ * and open no socket (unlike `check --mcp`, which connects to a live server), and
+ * `test` is not exposed at all because it spends tokens. That keeps the surface
+ * safe for an agent to call unattended.
+ *
+ * Built on the 2.x SDK line since 0.5.0. The 1.x line speaks 2025-11-25 and
+ * cannot answer `server/discover` or carry the SEP-2549 cache fields, so this
+ * server failed two MUST-level items of the specification the rest of this tool
+ * audits other servers against, and the skill this project publishes about that
+ * migration opens with "upgrade the SDK first". It was the only server we ship
+ * and the only one we had not migrated.
+ *
+ * `serveStdio` owns the era decision rather than this file: the opening exchange
+ * selects it, one instance is pinned for the connection, and a 2025-era client
+ * that opens with `initialize` is still served. Registering the tools once, on a
+ * factory that serves both eras, is the whole reason to use it instead of
+ * wiring a transport by hand.
+ */
 // Both tools only read local files, so the same hints apply: safe to call without
 // a confirmation, safe to repeat, and not reaching out to any external service.
 const READ_ONLY = { readOnlyHint: true, idempotentHint: true, openWorldHint: false };
-function requireString(args, key) {
-    const v = args[key];
-    if (typeof v !== "string" || v.trim() === "") {
-        throw new Error(`"${key}" is required and must be a non-empty string`);
-    }
-    return v;
-}
-const pathSchema = (what) => ({
-    type: "object",
-    properties: { path: { type: "string", description: what } },
-    required: ["path"],
-    additionalProperties: false,
+// One shared shape. `.min(1)` is the schema saying what `requireString` used to
+// say at runtime: an empty path is not a path. Under the 2.x registration the
+// SDK validates against this before the handler runs, so the check moved from
+// our code into the contract, which is where a client can also see it.
+const pathInput = (what) => z.object({ path: z.string().min(1).describe(what) });
+const CHECK_DESCRIPTION = "Lint an Agent Skill, or a folder of skills, for spec compliance, trigger quality, " +
+    "context-window cost, reference integrity, and injection hygiene. Returns a grade from " +
+    "A to F and the findings. Read-only: reads files only.";
+const WEIGH_DESCRIPTION = "Measure the context-window token cost of an Agent Skill: the metadata loaded into every " +
+    "session and the body loaded when the skill triggers. Returns token counts per skill. " +
+    "Read-only: reads files only.";
+const text = (s) => ({ content: [{ type: "text", text: s }] });
+const failure = (e) => ({
+    content: [{ type: "text", text: `error: ${e instanceof Error ? e.message : String(e)}` }],
+    isError: true,
 });
-const TOOLS = [
-    {
-        name: "efaimo_check_skill",
-        description: "Lint an Agent Skill, or a folder of skills, for spec compliance, trigger quality, " +
-            "context-window cost, reference integrity, and injection hygiene. Returns a grade from " +
-            "A to F and the findings. Read-only: reads files only.",
-        inputSchema: pathSchema("Path to a SKILL.md file or a directory that contains skills."),
+export function buildMcpServer() {
+    const server = new McpServer({ name: "efaimo", version: VERSION }, { capabilities: { tools: {} } });
+    server.registerTool("efaimo_check_skill", {
+        description: CHECK_DESCRIPTION,
+        inputSchema: pathInput("Path to a SKILL.md file or a directory that contains skills."),
         annotations: READ_ONLY,
-        async run(args) {
-            const p = requireString(args, "path");
-            const res = await checkSkillSet(p, p);
+    }, async ({ path }) => {
+        try {
+            const res = await checkSkillSet(path, path);
             if (res.perSkill.length === 1 && res.setFindings.length === 0) {
-                return renderCheckMarkdown(res.perSkill[0].report);
+                return text(renderCheckMarkdown(res.perSkill[0].report));
             }
-            return renderSkillSetMarkdown(res);
-        },
-    },
-    {
-        name: "efaimo_weigh_skill",
-        description: "Measure the context-window token cost of an Agent Skill: the metadata loaded into every " +
-            "session and the body loaded when the skill triggers. Returns token counts per skill. " +
-            "Read-only: reads files only.",
-        inputSchema: pathSchema("Path to a SKILL.md file or a directory that contains skills."),
-        annotations: READ_ONLY,
-        async run(args) {
-            const p = requireString(args, "path");
-            const set = findSkills(p);
-            if (!set.skills.length)
-                throw new Error(`no SKILL.md found under "${p}"`);
-            return renderWeighMarkdown(await weighSkills(set));
-        },
-    },
-];
-export function buildMcpServer() {
-    const server = new Server({ name: "efaimo", version: VERSION }, { capabilities: { tools: {} } });
-    server.setRequestHandler(ListToolsRequestSchema, () => ({
-        tools: TOOLS.map((t) => ({
-            name: t.name,
-            description: t.description,
-            inputSchema: t.inputSchema,
-            annotations: t.annotations,
-        })),
-    }));
-    server.setRequestHandler(CallToolRequestSchema, async (req) => {
-        const tool = TOOLS.find((t) => t.name === req.params.name);
-        if (!tool) {
-            return { content: [{ type: "text", text: `unknown tool: ${req.params.name}` }], isError: true };
+            return text(renderSkillSetMarkdown(res));
         }
+        catch (e) {
+            return failure(e);
+        }
+    });
+    server.registerTool("efaimo_weigh_skill", {
+        description: WEIGH_DESCRIPTION,
+        inputSchema: pathInput("Path to a SKILL.md file or a directory that contains skills."),
+        annotations: READ_ONLY,
+    }, async ({ path }) => {
         try {
-            const text = await tool.run(req.params.arguments ?? {});
-            return { content: [{ type: "text", text }] };
+            const set = findSkills(path);
+            if (!set.skills.length)
+                throw new Error(`no SKILL.md found under "${path}"`);
+            return text(renderWeighMarkdown(await weighSkills(set)));
         }
         catch (e) {
-            const message = e instanceof Error ? e.message : String(e);
-            return { content: [{ type: "text", text: `error: ${message}` }], isError: true };
+            return failure(e);
         }
     });
     return server;
 }
 export async function runMcpServer() {
-    const server = buildMcpServer();
-    await server.connect(new StdioServerTransport());
+    // A factory, not an instance: `serveStdio` pins one per connection after the
+    // opening exchange tells it which era it is talking to.
+    serveStdio(() => buildMcpServer(), {
+        onerror: (e) => console.error(`efaimo mcp: ${e.message}`),
+    });
     console.error(`efaimo mcp v${VERSION}: read-only skill tools ready on stdio`);
+    // stdin holds the process open; there is nothing to await. Returning a promise
+    // that never settles would only make the shutdown path harder to read.
+    await new Promise(() => { });
 }

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** Kept in sync with package.json by test/meta.test.ts. */
-export declare const VERSION = "0.4.0";
+export declare const VERSION = "0.5.0";

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Kept in sync with package.json by test/meta.test.ts. */
-export const VERSION = "0.4.0";
+export const VERSION = "0.5.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "efaimo",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Audit what your agent loads: quality and context cost for MCP servers and Agent Skills",
   "keywords": [
     "mcp",
@@ -65,12 +65,14 @@
     "prepublishOnly": "npm run typecheck && npm run build && npm run test"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/client": "2.0.0",
+    "@modelcontextprotocol/server": "2.0.0",
     "commander": "^15.0.0",
     "cross-spawn": "^7.0.6",
     "gpt-tokenizer": "^3.4.0",
     "picocolors": "^1.1.1",
-    "yaml": "^2.9.0"
+    "yaml": "^2.9.0",
+    "zod": "^4.5.4"
   },
   "devDependencies": {
     "@types/cross-spawn": "^6.0.6",