meritmcp 0.1.1

package/dist/src/security/static/unicode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unicode.js","sourceRoot":"","sources":["../../../../src/security/static/unicode.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,GAA4D;IAC1E,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;IACtG,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,EAAE;IACnH,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,OAAO,IAAI,EAAE,IAAI,OAAO,EAAE;IAChF,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,EAAE;CACvE,CAAC;AAQF,MAAM,UAAU,WAAW,CAAC,MAAsB;IAChD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC5C,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC1B,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,EAAE,KAAK,SAAS;gBAAE,SAAS;YAC/B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;oBAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACZ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACzF,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,gBAAgB;gBACxB,KAAK,EAAE,YAAY;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,OAAO,EAAE,UAAU,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,KAAK,mCAAmC;gBAChG,QAAQ,EAAE,GAAG,CAAC,QAAQ;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/snapshot/canonicalize.js

@@ -0,0 +1,11 @@
+// Deterministic hashing for schema snapshots: stable (key-sorted) stringify + SHA-256.
+// (json-stable-stringify / JCS nuances can be swapped in later behind this one module.)
+import { stringify } from "safe-stable-stringify";
+import { createHash } from "node:crypto";
+export function sha256(input) {
+    return createHash("sha256").update(input).digest("hex");
+}
+export function canonicalHash(obj) {
+    return sha256(stringify(obj) ?? "null");
+}
+//# sourceMappingURL=canonicalize.js.map

package/dist/src/snapshot/canonicalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalize.js","sourceRoot":"","sources":["../../../src/snapshot/canonicalize.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,wFAAwF;AACxF,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC;AAC1C,CAAC"}

package/dist/src/snapshot/capture.js

@@ -0,0 +1,26 @@
+import { canonicalHash } from "./canonicalize.js";
+export function capture(tools) {
+    const entries = {};
+    for (const t of tools) {
+        entries[t.name] = {
+            hash: canonicalHash({
+                name: t.name,
+                description: t.description,
+                inputSchema: t.inputSchema,
+                outputSchema: t.outputSchema,
+                annotations: t.annotations,
+            }),
+            shash: canonicalHash({
+                name: t.name,
+                inputSchema: t.inputSchema,
+                outputSchema: t.outputSchema,
+                annotations: t.annotations,
+            }),
+        };
+    }
+    const rootHash = canonicalHash(Object.keys(entries)
+        .sort()
+        .map((n) => [n, entries[n].hash]));
+    return { version: 1, createdAt: new Date().toISOString(), rootHash, tools: entries };
+}
+//# sourceMappingURL=capture.js.map

package/dist/src/snapshot/capture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture.js","sourceRoot":"","sources":["../../../src/snapshot/capture.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAclD,MAAM,UAAU,OAAO,CAAC,KAAiB;IACvC,MAAM,OAAO,GAAiC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG;YAChB,IAAI,EAAE,aAAa,CAAC;gBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAC;YACF,KAAK,EAAE,aAAa,CAAC;gBACnB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAC;SACH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;SACjB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CACpC,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACvF,CAAC"}

package/dist/src/snapshot/diff.js

@@ -0,0 +1,26 @@
+export function diff(prev, next) {
+    const added = [];
+    const removed = [];
+    const schemaChanged = [];
+    const descriptionOnly = [];
+    for (const name of Object.keys(next.tools))
+        if (!prev.tools[name])
+            added.push(name);
+    for (const name of Object.keys(prev.tools)) {
+        const a = prev.tools[name];
+        const b = next.tools[name];
+        if (!b) {
+            removed.push(name);
+            continue;
+        }
+        if (a.hash !== b.hash) {
+            if (a.shash !== b.shash)
+                schemaChanged.push(name);
+            else
+                descriptionOnly.push(name);
+        }
+    }
+    const changed = added.length + removed.length + schemaChanged.length + descriptionOnly.length > 0;
+    return { hasSnapshot: true, changed, added, removed, schemaChanged, descriptionOnly };
+}
+//# sourceMappingURL=diff.js.map

package/dist/src/snapshot/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../../src/snapshot/diff.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,IAAI,CAAC,IAAc,EAAE,IAAc;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,eAAe,GAAa,EAAE,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEpF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;gBAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBAC7C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAClG,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AACxF,CAAC"}

package/dist/src/types.js

@@ -0,0 +1,3 @@
+// Shared, typed models. The whole pipeline produces a single `Report`.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,uEAAuE"}

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "meritmcp",
+  "version": "0.1.1",
+  "description": "The CI quality gate for MCP servers — functional tests + official conformance + OWASP-MCP-Top-10 security in one command, with SARIF, a 0-100 safety score, and a README badge.",
+  "type": "module",
+  "license": "MIT",
+  "author": "'//e0",
+  "homepage": "https://github.com/meritmcp/meritmcp#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/meritmcp/meritmcp.git"
+  },
+  "bugs": {
+    "url": "https://github.com/meritmcp/meritmcp/issues"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "bin": {
+    "merit": "dist/src/cli.js"
+  },
+  "files": [
+    "dist/src",
+    "config",
+    "schemas",
+    "action.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsx src/cli.ts",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm run typecheck && npm run test && npm run build",
+    "fixture:clean": "tsx fixtures/clean-server/server.ts",
+    "fixture:vulnerable": "tsx fixtures/vulnerable-server/server.ts",
+    "demo:pass": "npm run build && node dist/src/cli.js run --stdio \"node dist/fixtures/clean-server/server.js\" --tests merit.tests.yaml",
+    "demo:fail": "npm run build && node dist/src/cli.js run --stdio \"node dist/fixtures/vulnerable-server/server.js\" --tests merit.tests.yaml --probe"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "security",
+    "conformance",
+    "testing",
+    "owasp",
+    "sarif",
+    "badge",
+    "ci"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/conformance": "0.1.16",
+    "ajv": "^8.17.1",
+    "ajv-formats": "^3.0.1",
+    "commander": "^14.0.0",
+    "safe-stable-stringify": "^2.5.0",
+    "yaml": "^2.7.0",
+    "zod": "^3.25.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0",
+    "vitest": "^2.1.0"
+  }
+}

package/schemas/tests.schema.json

@@ -0,0 +1,53 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://meritmcp.dev/schemas/tests.schema.json",
+  "title": "Merit functional test spec",
+  "type": "object",
+  "required": ["tests"],
+  "additionalProperties": false,
+  "properties": {
+    "version": { "const": 1 },
+    "target": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "transport": { "enum": ["stdio", "http"] },
+        "command": { "type": "string" },
+        "url": { "type": "string" },
+        "env": { "type": "object", "additionalProperties": { "type": "string" } }
+      }
+    },
+    "tests": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["name", "op", "assert"],
+        "additionalProperties": false,
+        "properties": {
+          "name": { "type": "string" },
+          "op": { "enum": ["list_tools", "call_tool"] },
+          "tool": { "type": "string" },
+          "arguments": { "type": "object" },
+          "assert": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "not_error": { "type": "boolean" },
+              "is_error": { "type": "boolean" },
+              "content_contains": { "type": "string" },
+              "content_matches": { "type": "string" },
+              "error_contains": { "type": "string" },
+              "tool_count": { "type": "integer" },
+              "contains_tools": { "type": "array", "items": { "type": "string" } },
+              "structured": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": { "json_schema": { "type": "object" } }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}