mcp-scorecard 0.5.0 → 0.5.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +18 -0
- package/CONTRIBUTING.md +28 -0
- package/README.md +5 -1
- package/SECURITY.md +18 -0
- package/dist/cli/commands.js +4 -6
- package/dist/cli/commands.js.map +1 -1
- package/dist/constants.d.ts +1 -1
- package/dist/constants.js +1 -1
- package/dist/mcp-server.js +2 -4
- package/dist/mcp-server.js.map +1 -1
- package/dist/resolvers/local-resolver.d.ts +10 -1
- package/dist/resolvers/local-resolver.js +71 -3
- package/dist/resolvers/local-resolver.js.map +1 -1
- package/package.json +14 -3
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,23 @@
|
|
|
1
|
+
## 0.5.2 - 2026-07-30
|
|
2
|
+
|
|
3
|
+
### Fixed
|
|
4
|
+
|
|
5
|
+
- CLI resolves relative paths and package directories offline (not only absolute file paths), so local scoring of a repo dir works without going to npm.
|
|
6
|
+
|
|
1
7
|
# Changelog
|
|
2
8
|
|
|
9
|
+
## Unreleased
|
|
10
|
+
|
|
11
|
+
### Fixes
|
|
12
|
+
|
|
13
|
+
- Local subjects: relative paths and package directories resolve offline (`./dist/index.js`, package root via `bin`/`main`), matching the CLI docs for end-to-end local audits.
|
|
14
|
+
|
|
15
|
+
## 0.5.1 - 2026-06-27
|
|
16
|
+
|
|
17
|
+
### Security
|
|
18
|
+
|
|
19
|
+
- Pin transitive `hono` resolution to `4.12.27` via npm overrides, resolving production audit advisories while keeping the public CLI and MCP API unchanged.
|
|
20
|
+
|
|
3
21
|
## 0.5.0
|
|
4
22
|
|
|
5
23
|
- **The `audit` MCP tool now ships agent-expanding metadata** (dogfooding our own checks):
|
package/CONTRIBUTING.md
ADDED
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
# Contributing
|
|
2
|
+
|
|
3
|
+
Contributions should make MCP servers easier for agents to discover, audit and
|
|
4
|
+
use safely.
|
|
5
|
+
|
|
6
|
+
## Good Areas
|
|
7
|
+
|
|
8
|
+
- New checks with clear, deterministic scoring.
|
|
9
|
+
- Better suggested fixes for common MCP readiness failures.
|
|
10
|
+
- Regression tests for stdio, hosted, remote and metadata probes.
|
|
11
|
+
- Documentation that helps maintainers fix their own score.
|
|
12
|
+
|
|
13
|
+
## Development
|
|
14
|
+
|
|
15
|
+
```bash
|
|
16
|
+
npm install
|
|
17
|
+
npm test
|
|
18
|
+
```
|
|
19
|
+
|
|
20
|
+
`npm test` must stay offline and must not require target server credentials.
|
|
21
|
+
|
|
22
|
+
## Pull Request Checklist
|
|
23
|
+
|
|
24
|
+
- Add or update tests for any scoring change.
|
|
25
|
+
- Keep findings actionable: every failure should explain what to change.
|
|
26
|
+
- Do not collect, persist or print target secrets.
|
|
27
|
+
- Do not make network calls from stdio checks unless the user explicitly chose a
|
|
28
|
+
hosted/remote audit mode.
|
package/README.md
CHANGED
|
@@ -3,9 +3,11 @@
|
|
|
3
3
|
<p align="center">
|
|
4
4
|
<a href="https://github.com/davidmosiah/mcp-scorecard/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/davidmosiah/mcp-scorecard/ci.yml?style=for-the-badge&labelColor=0F172A&color=10B981&logo=github" alt="CI" /></a>
|
|
5
5
|
<a href="https://www.npmjs.com/package/mcp-scorecard"><img src="https://img.shields.io/npm/v/mcp-scorecard?style=for-the-badge&labelColor=0F172A&color=10B981&logo=npm&logoColor=white" alt="npm version" /></a>
|
|
6
|
+
<a href="https://github.com/davidmosiah/mcp-scorecard/releases/latest"><img src="https://img.shields.io/github/v/release/davidmosiah/mcp-scorecard?style=for-the-badge&labelColor=0F172A&color=2563EB&logo=github" alt="GitHub release" /></a>
|
|
6
7
|
<a href="https://www.npmjs.com/package/mcp-scorecard"><img src="https://img.shields.io/npm/dm/mcp-scorecard?style=for-the-badge&labelColor=0F172A&color=0EA5A3&logo=npm&logoColor=white" alt="npm downloads" /></a>
|
|
7
8
|
<a href="LICENSE"><img src="https://img.shields.io/badge/LICENSE-MIT-22C55E?style=for-the-badge&labelColor=0F172A" alt="License MIT" /></a>
|
|
8
9
|
<a href="https://modelcontextprotocol.io"><img src="https://img.shields.io/badge/BUILT_FOR-MCP-7C3AED?style=for-the-badge&labelColor=0F172A" alt="Built for MCP" /></a>
|
|
10
|
+
<a href="https://github.com/davidmosiah/delx-wellness/blob/main/docs/release-index.md"><img src="https://img.shields.io/badge/VERIFIED-release_index-0EA5A3?style=for-the-badge&labelColor=0F172A" alt="Verified release index" /></a>
|
|
9
11
|
</p>
|
|
10
12
|
|
|
11
13
|
<h3 align="center">
|
|
@@ -24,8 +26,10 @@ npx -y mcp-scorecard whoop-mcp-unofficial
|
|
|
24
26
|
# Audit a GitHub repo (auto-resolves to the published npm package, or local dist)
|
|
25
27
|
npx -y mcp-scorecard https://github.com/davidmosiah/whoop-mcp
|
|
26
28
|
|
|
27
|
-
# Audit a local build
|
|
29
|
+
# Audit a local build (entry file or package directory)
|
|
28
30
|
npx -y mcp-scorecard /Users/you/Desktop/my-mcp/dist/index.js
|
|
31
|
+
npx -y mcp-scorecard ./my-mcp # resolves package.json bin/main
|
|
32
|
+
npx -y mcp-scorecard ./dist/index.js # relative paths work offline
|
|
29
33
|
|
|
30
34
|
# CI gate: fail the build if the score drops
|
|
31
35
|
npx -y mcp-scorecard my-mcp --min-score 80
|
package/SECURITY.md
ADDED
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
# Security Policy
|
|
2
|
+
|
|
3
|
+
Report security issues privately when they involve credentials, private MCP
|
|
4
|
+
payloads, local files, hosted endpoints or target server behavior that should not
|
|
5
|
+
be disclosed publicly.
|
|
6
|
+
|
|
7
|
+
Do not paste API keys, OAuth tokens, private MCP responses, customer data,
|
|
8
|
+
internal URLs or local secrets into public issues or pull requests.
|
|
9
|
+
|
|
10
|
+
`mcp-scorecard` is designed to probe MCP servers without forwarding your shell
|
|
11
|
+
secrets. If a target server needs credentials merely to list tools, it should
|
|
12
|
+
detect `MCP_PROBE=1` and return its manifest safely.
|
|
13
|
+
|
|
14
|
+
For private reports, contact:
|
|
15
|
+
|
|
16
|
+
```text
|
|
17
|
+
support@delx.ai
|
|
18
|
+
```
|
package/dist/cli/commands.js
CHANGED
|
@@ -7,19 +7,17 @@
|
|
|
7
7
|
* --version print scorecard version
|
|
8
8
|
* --help, -h print usage
|
|
9
9
|
*/
|
|
10
|
-
import {
|
|
11
|
-
import { isAbsolute } from 'node:path';
|
|
10
|
+
import { readFileSync } from 'node:fs';
|
|
12
11
|
import { SERVER_VERSION } from '../constants.js';
|
|
13
12
|
import { runAudit } from '../audit/runner.js';
|
|
14
13
|
import { resolveGithubRepo } from '../resolvers/github-resolver.js';
|
|
15
|
-
import { resolveLocal } from '../resolvers/local-resolver.js';
|
|
14
|
+
import { isLocalSubject, resolveLocal } from '../resolvers/local-resolver.js';
|
|
16
15
|
import { resolveNpmPackage } from '../resolvers/npm-resolver.js';
|
|
17
16
|
import { runWebAudit } from '../audit/web/web-runner.js';
|
|
18
17
|
/** A hosted/remote target (http[s] URL that isn't a GitHub repo) → web audit path. */
|
|
19
18
|
function isWebTarget(subject) {
|
|
20
19
|
return /^https?:\/\//.test(subject) && !/github\.com/.test(subject);
|
|
21
20
|
}
|
|
22
|
-
import { readFileSync } from 'node:fs';
|
|
23
21
|
import { applyProfile, isProfile } from '../profiles.js';
|
|
24
22
|
import { renderBadge, renderBaseline, renderCompare, renderHtml, renderJson, renderMarkdown } from './output.js';
|
|
25
23
|
const USAGE = `mcp-scorecard v${SERVER_VERSION}
|
|
@@ -33,7 +31,7 @@ Subjects:
|
|
|
33
31
|
npm-package e.g. whoop-mcp-unofficial[@version]
|
|
34
32
|
github-url e.g. https://github.com/davidmosiah/whoop-mcp
|
|
35
33
|
https://host a HOSTED/remote MCP server or site (web security + agent-readiness audit)
|
|
36
|
-
/abs/path/dist/index.js built MCP server entry
|
|
34
|
+
/abs/path/dist/index.js built MCP server entry (or package dir / relative path)
|
|
37
35
|
|
|
38
36
|
Flags:
|
|
39
37
|
--json emit structured JSON to stdout
|
|
@@ -91,7 +89,7 @@ function parseArgs(argv) {
|
|
|
91
89
|
function classifySubject(subject) {
|
|
92
90
|
if (/^https?:\/\/github\.com\//.test(subject) || /^github:/.test(subject))
|
|
93
91
|
return 'github';
|
|
94
|
-
if (
|
|
92
|
+
if (isLocalSubject(subject))
|
|
95
93
|
return 'local';
|
|
96
94
|
return 'npm';
|
|
97
95
|
}
|
package/dist/cli/commands.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/cli/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/cli/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,sFAAsF;AACtF,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtE,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEjH,MAAM,KAAK,GAAG,kBAAkB,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;4EAyB8B,CAAC;AAc7E,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACjH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aACjD,IAAI,GAAG,KAAK,WAAW;YAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC;aAChD,IAAI,GAAG,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aACtC,IAAI,GAAG,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;aACxC,IAAI,GAAG,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aACtC,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAC9B,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC9F,CAAC;aAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/B,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAChI,CAAC;aAAM,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAC;YACpF,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;QACnB,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACxB,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3F,IAAI,cAAc,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAe;IAC3C,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,YAAY,CAAC,OAAe;IACzC,IAAI,WAAW,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,QAAQ,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc;IACtC,oFAAoF;IACpF,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACnD,MAAM,KAAK,EAAE,CAAC;QACd,sEAAsE;QACtE,uDAAuD;QACvD,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,+DAA+D;IAC/D,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,KAAK,IAAI,CAAC,CAAC;YACzE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;QAC1F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,cAAc,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,KAAK,IAAI,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAElE,IAAI,QAAiC,CAAC;IACtC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAgB,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrG,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;YAClC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;gBAClC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC;oBAC7C,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAEjC,IAAI,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,UAAU,kBAAkB,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QACxF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
|
package/dist/constants.d.ts
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
* same string. Bumping this without updating package.json is intentional during
|
|
4
4
|
* dev (keep src as source of truth); a release script can sync them.
|
|
5
5
|
*/
|
|
6
|
-
export declare const SERVER_VERSION = "0.5.
|
|
6
|
+
export declare const SERVER_VERSION = "0.5.2";
|
|
7
7
|
/** Identifier used when the probe connects to a target MCP server. */
|
|
8
8
|
export declare const PROBE_CLIENT_NAME = "mcp-scorecard";
|
|
9
9
|
/** Env var set on the spawned target so MCP authors can detect we are probing
|
package/dist/constants.js
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
* same string. Bumping this without updating package.json is intentional during
|
|
4
4
|
* dev (keep src as source of truth); a release script can sync them.
|
|
5
5
|
*/
|
|
6
|
-
export const SERVER_VERSION = '0.5.
|
|
6
|
+
export const SERVER_VERSION = '0.5.2';
|
|
7
7
|
/** Identifier used when the probe connects to a target MCP server. */
|
|
8
8
|
export const PROBE_CLIENT_NAME = 'mcp-scorecard';
|
|
9
9
|
/** Env var set on the spawned target so MCP authors can detect we are probing
|
package/dist/mcp-server.js
CHANGED
|
@@ -6,8 +6,6 @@
|
|
|
6
6
|
* Uses the low-level Server + setRequestHandler API with a plain JSON-Schema
|
|
7
7
|
* tool definition (no zod shape) to stay decoupled from the SDK's zod version.
|
|
8
8
|
*/
|
|
9
|
-
import { existsSync } from 'node:fs';
|
|
10
|
-
import { isAbsolute } from 'node:path';
|
|
11
9
|
import { Server } from '@modelcontextprotocol/sdk/server/index.js';
|
|
12
10
|
import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
|
|
13
11
|
import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
|
|
@@ -15,7 +13,7 @@ import { SERVER_VERSION } from './constants.js';
|
|
|
15
13
|
import { runAudit } from './audit/runner.js';
|
|
16
14
|
import { runWebAudit } from './audit/web/web-runner.js';
|
|
17
15
|
import { resolveGithubRepo } from './resolvers/github-resolver.js';
|
|
18
|
-
import { resolveLocal } from './resolvers/local-resolver.js';
|
|
16
|
+
import { isLocalSubject, resolveLocal } from './resolvers/local-resolver.js';
|
|
19
17
|
import { resolveNpmPackage } from './resolvers/npm-resolver.js';
|
|
20
18
|
/**
|
|
21
19
|
* JSON Schema for the audit tool's structured output (mirrors AuditReport).
|
|
@@ -67,7 +65,7 @@ async function auditTarget(target) {
|
|
|
67
65
|
if (/^https?:\/\/github\.com\//.test(target) || target.startsWith('github:')) {
|
|
68
66
|
resolved = await resolveGithubRepo(target);
|
|
69
67
|
}
|
|
70
|
-
else if (
|
|
68
|
+
else if (isLocalSubject(target)) {
|
|
71
69
|
resolved = await resolveLocal(target);
|
|
72
70
|
}
|
|
73
71
|
else {
|
package/dist/mcp-server.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mcp-server.js","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"mcp-server.js","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE;;;;GAIG;AACH,MAAM,mBAAmB,GAAG;IAC1B,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC/B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC9B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAClC;YACD,QAAQ,EAAE,CAAC,aAAa,CAAC;SAC1B;QACD,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wCAAwC,EAAE;QACrF,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE;QAC1D,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;QAChD,MAAM,EAAE;YACN,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;oBAC1D,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACrD,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;iBACpD;gBACD,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC;aAC7C;SACF;QACD,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC/B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACrC;IACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,kBAAkB,CAAC;CACjG,CAAC;AAEF,KAAK,UAAU,WAAW,CAAC,MAAc;IACvC,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,QAAQ,CAAC;IACb,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,EAClD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,OAAO;gBACb,WAAW,EACT,0SAA0S;gBAC5S,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,yEAAyE;yBACvF;qBACF;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;gBACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;gBAC9E,YAAY,EAAE,mBAAmB;aAClC;SACF;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5D,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAClG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAE,GAAG,CAAC,MAAM,CAAC,SAAiD,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1G,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACnG,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,UAAU,eAAe,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC;YACtH,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;gBACrF,iBAAiB,EAAE,MAA4C;aAChE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,MAAM,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACtH,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,6BAA6B,cAAc,gCAAgC,CAAC,CAAC;AAC7F,CAAC"}
|
|
@@ -1,8 +1,17 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Local resolver — the subject is
|
|
2
|
+
* Local resolver — the subject is a path to a built MCP binary or a package
|
|
3
|
+
* directory whose package.json declares a bin/main entry.
|
|
3
4
|
*
|
|
4
5
|
* The packageDir is the nearest ancestor containing package.json (so smoke
|
|
5
6
|
* test detection and version display work). We launch with `node <path>`.
|
|
6
7
|
*/
|
|
7
8
|
import type { ResolvedTarget } from '../types.js';
|
|
9
|
+
/** Absolute path for a subject, whether the user passed abs or relative. */
|
|
10
|
+
export declare function resolveSubjectPath(targetPath: string): string;
|
|
11
|
+
/**
|
|
12
|
+
* True when the subject should be treated as a local filesystem target
|
|
13
|
+
* (not an npm package name). Absolute paths, relative path-like strings,
|
|
14
|
+
* and *.mjs/*.js/*.cjs files that exist on disk qualify.
|
|
15
|
+
*/
|
|
16
|
+
export declare function isLocalSubject(subject: string): boolean;
|
|
8
17
|
export declare function resolveLocal(targetPath: string): ResolvedTarget;
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Local resolver — the subject is
|
|
2
|
+
* Local resolver — the subject is a path to a built MCP binary or a package
|
|
3
|
+
* directory whose package.json declares a bin/main entry.
|
|
3
4
|
*
|
|
4
5
|
* The packageDir is the nearest ancestor containing package.json (so smoke
|
|
5
6
|
* test detection and version display work). We launch with `node <path>`.
|
|
@@ -26,14 +27,81 @@ function findPackageRoot(start) {
|
|
|
26
27
|
}
|
|
27
28
|
return { dir: start };
|
|
28
29
|
}
|
|
30
|
+
/** Absolute path for a subject, whether the user passed abs or relative. */
|
|
31
|
+
export function resolveSubjectPath(targetPath) {
|
|
32
|
+
return isAbsolute(targetPath) ? targetPath : pathResolve(process.cwd(), targetPath);
|
|
33
|
+
}
|
|
34
|
+
/**
|
|
35
|
+
* True when the subject should be treated as a local filesystem target
|
|
36
|
+
* (not an npm package name). Absolute paths, relative path-like strings,
|
|
37
|
+
* and *.mjs/*.js/*.cjs files that exist on disk qualify.
|
|
38
|
+
*/
|
|
39
|
+
export function isLocalSubject(subject) {
|
|
40
|
+
const abs = resolveSubjectPath(subject);
|
|
41
|
+
if (!existsSync(abs))
|
|
42
|
+
return false;
|
|
43
|
+
if (isAbsolute(subject))
|
|
44
|
+
return true;
|
|
45
|
+
// Relative: only claim local when it looks like a path/file, so bare
|
|
46
|
+
// npm package names that happen to match a cwd file stay npm-resolved.
|
|
47
|
+
if (subject.startsWith('.') || subject.includes('/') || subject.includes('\\'))
|
|
48
|
+
return true;
|
|
49
|
+
return /\.(m?js|cjs)$/i.test(subject);
|
|
50
|
+
}
|
|
51
|
+
function resolvePackageEntry(dir, pkg) {
|
|
52
|
+
const bin = pkg.bin;
|
|
53
|
+
if (typeof bin === 'string')
|
|
54
|
+
return pathResolve(dir, bin);
|
|
55
|
+
if (bin && typeof bin === 'object' && !Array.isArray(bin)) {
|
|
56
|
+
const values = Object.values(bin);
|
|
57
|
+
const first = values.find((v) => typeof v === 'string');
|
|
58
|
+
if (first)
|
|
59
|
+
return pathResolve(dir, first);
|
|
60
|
+
}
|
|
61
|
+
if (typeof pkg.main === 'string')
|
|
62
|
+
return pathResolve(dir, pkg.main);
|
|
63
|
+
for (const candidate of ['dist/index.js', 'index.js', 'src/index.js']) {
|
|
64
|
+
const p = pathResolve(dir, candidate);
|
|
65
|
+
if (existsSync(p))
|
|
66
|
+
return p;
|
|
67
|
+
}
|
|
68
|
+
return undefined;
|
|
69
|
+
}
|
|
29
70
|
export function resolveLocal(targetPath) {
|
|
30
|
-
const abs =
|
|
71
|
+
const abs = resolveSubjectPath(targetPath);
|
|
31
72
|
if (!existsSync(abs)) {
|
|
32
73
|
throw new Error(`Local target does not exist: ${abs}`);
|
|
33
74
|
}
|
|
34
75
|
const st = statSync(abs);
|
|
76
|
+
if (st.isDirectory()) {
|
|
77
|
+
const pkgPath = pathResolve(abs, 'package.json');
|
|
78
|
+
if (!existsSync(pkgPath)) {
|
|
79
|
+
throw new Error(`Local directory has no package.json: ${abs}`);
|
|
80
|
+
}
|
|
81
|
+
let pkg;
|
|
82
|
+
try {
|
|
83
|
+
pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
|
|
84
|
+
}
|
|
85
|
+
catch {
|
|
86
|
+
throw new Error(`Local directory has unparseable package.json: ${abs}`);
|
|
87
|
+
}
|
|
88
|
+
const entry = resolvePackageEntry(abs, pkg);
|
|
89
|
+
if (!entry || !existsSync(entry)) {
|
|
90
|
+
throw new Error(`Could not resolve MCP entry from package.json bin/main in ${abs}. Pass the built file path explicitly (e.g. dist/index.js).`);
|
|
91
|
+
}
|
|
92
|
+
const displayName = pkg.name ?? abs;
|
|
93
|
+
const version = pkg.version;
|
|
94
|
+
return {
|
|
95
|
+
displayName,
|
|
96
|
+
version,
|
|
97
|
+
command: 'node',
|
|
98
|
+
args: [entry],
|
|
99
|
+
packageDir: abs,
|
|
100
|
+
packageJson: pkg
|
|
101
|
+
};
|
|
102
|
+
}
|
|
35
103
|
if (!st.isFile()) {
|
|
36
|
-
throw new Error(`Local target must be a file
|
|
104
|
+
throw new Error(`Local target must be a file or package directory: ${abs}`);
|
|
37
105
|
}
|
|
38
106
|
const { dir, pkg } = findPackageRoot(dirname(abs));
|
|
39
107
|
const displayName = pkg?.name ?? abs;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"local-resolver.js","sourceRoot":"","sources":["../../src/resolvers/local-resolver.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"local-resolver.js","sourceRoot":"","sources":["../../src/resolvers/local-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAGxE,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACnD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;gBACxD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,8BAA8B;YAChC,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;AACtF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,qEAAqE;IACrE,uEAAuE;IACvE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5F,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,GAA4B;IACpE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAA8B,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACrE,IAAI,KAAK;YAAE,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpE,KAAK,MAAM,SAAS,IAAI,CAAC,eAAe,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACtC,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,MAAM,GAAG,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAEzB,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAA4B,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6DAA6D,GAAG,6DAA6D,CAC9H,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAI,GAAG,CAAC,IAA2B,IAAI,GAAG,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,OAA6B,CAAC;QAClD,OAAO;YACL,WAAW;YACX,OAAO;YACP,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,CAAC,KAAK,CAAC;YACb,UAAU,EAAE,GAAG;YACf,WAAW,EAAE,GAAG;SACjB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,MAAM,WAAW,GAAI,GAAG,EAAE,IAA2B,IAAI,GAAG,CAAC;IAC7D,MAAM,OAAO,GAAG,GAAG,EAAE,OAA6B,CAAC;IACnD,OAAO;QACL,WAAW;QACX,OAAO;QACP,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,CAAC,GAAG,CAAC;QACX,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,GAAG;KACjB,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "mcp-scorecard",
|
|
3
|
-
"version": "0.5.
|
|
3
|
+
"version": "0.5.2",
|
|
4
4
|
"mcpName": "io.github.davidmosiah/mcp-scorecard",
|
|
5
|
-
"description": "Grade any MCP server's agent-readiness in one command
|
|
5
|
+
"description": "Grade any MCP server's agent-readiness in one command \u2014 stdio (10 protocol checks) AND hosted/remote servers (10 security + web agent-readiness checks). Open source, local-first, no credentials.",
|
|
6
6
|
"type": "module",
|
|
7
7
|
"bin": {
|
|
8
8
|
"mcp-scorecard": "dist/index.js"
|
|
@@ -13,6 +13,8 @@
|
|
|
13
13
|
"LICENSE",
|
|
14
14
|
"CHANGELOG.md",
|
|
15
15
|
"AGENTS.md",
|
|
16
|
+
"SECURITY.md",
|
|
17
|
+
"CONTRIBUTING.md",
|
|
16
18
|
"llms.txt"
|
|
17
19
|
],
|
|
18
20
|
"scripts": {
|
|
@@ -38,6 +40,10 @@
|
|
|
38
40
|
],
|
|
39
41
|
"author": "David Mosiah",
|
|
40
42
|
"license": "MIT",
|
|
43
|
+
"funding": {
|
|
44
|
+
"type": "github",
|
|
45
|
+
"url": "https://github.com/sponsors/davidmosiah"
|
|
46
|
+
},
|
|
41
47
|
"dependencies": {
|
|
42
48
|
"@modelcontextprotocol/sdk": "^1.21.0",
|
|
43
49
|
"ajv": "^8.17.1",
|
|
@@ -63,5 +69,10 @@
|
|
|
63
69
|
"publishConfig": {
|
|
64
70
|
"access": "public"
|
|
65
71
|
},
|
|
66
|
-
"main": "dist/index.js"
|
|
72
|
+
"main": "dist/index.js",
|
|
73
|
+
"overrides": {
|
|
74
|
+
"hono": "4.12.27",
|
|
75
|
+
"esbuild": "0.28.1",
|
|
76
|
+
"@hono/node-server": "2.0.12"
|
|
77
|
+
}
|
|
67
78
|
}
|