raven-mcp 1.0.0 → 1.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SECURITY.md +74 -0
- package/dist/index.js +972 -0
- package/dist/index.js.map +1 -1
- package/package.json +9 -5
- package/scripts/postinstall.cjs +37 -0
- package/src/data/principles/component-architecture.json +103 -0
- package/src/data/principles/mobile-ux.json +180 -0
- package/src/data/principles/responsive-layout.json +95 -0
- package/src/data/tokens/registry.json +57 -12
- package/src/data/tokens/systems/airbnb.json +187 -0
- package/src/data/tokens/systems/apple-hig.json +152 -0
- package/src/data/tokens/systems/github-primer.json +154 -0
- package/src/data/tokens/systems/material-design.json +235 -0
- package/src/data/tokens/systems/notion.json +160 -0
- package/src/data/tokens/systems/shadcn.json +162 -0
- package/src/data/tokens/systems/spotify.json +155 -0
- package/src/data/tokens/systems/supabase.json +179 -0
- package/src/data/tokens/systems/tailwind.json +279 -0
- package/src/data/tokens/systems/vercel.json +145 -0
package/SECURITY.md
ADDED
|
@@ -0,0 +1,74 @@
|
|
|
1
|
+
# Security Policy — Raven MCP
|
|
2
|
+
|
|
3
|
+
## Data Flow
|
|
4
|
+
|
|
5
|
+
Raven MCP runs entirely locally. Here is the complete data flow:
|
|
6
|
+
|
|
7
|
+
```
|
|
8
|
+
Claude (prompt) → MCP Protocol (stdio) → Raven MCP (local process) → Response (text)
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
### What Raven reads
|
|
12
|
+
- User prompts passed via the MCP protocol from Claude Code or Claude Desktop
|
|
13
|
+
- Static JSON files bundled in the package (design principles, patterns, tokens)
|
|
14
|
+
|
|
15
|
+
### What Raven returns
|
|
16
|
+
- Text responses (JSON) containing design principles, patterns, tokens, and evaluations
|
|
17
|
+
- All responses are returned via stdio to the calling MCP client (Claude)
|
|
18
|
+
|
|
19
|
+
### What Raven does NOT do
|
|
20
|
+
- No network requests during tool execution — all data is local JSON loaded at startup
|
|
21
|
+
- No file system reads beyond its own bundled data files
|
|
22
|
+
- No logging of user prompts, code, or design artifacts
|
|
23
|
+
- No collection of PII or customer data
|
|
24
|
+
- No external API calls, database connections, or cloud service integrations
|
|
25
|
+
- No access to environment variables, secrets, or credentials during tool execution
|
|
26
|
+
|
|
27
|
+
### Optional telemetry (postinstall only)
|
|
28
|
+
On `npm install`, an optional postinstall script sends a single HTTPS POST to `ravenmcp.ai/api/welcome` containing:
|
|
29
|
+
- Node.js version
|
|
30
|
+
- OS platform and architecture
|
|
31
|
+
- Timestamp
|
|
32
|
+
|
|
33
|
+
**No user data, prompts, code, or design artifacts are sent.** This telemetry is limited to install-time only and never runs during tool execution.
|
|
34
|
+
|
|
35
|
+
**To disable:** Set `RAVEN_NO_TELEMETRY=1` before install:
|
|
36
|
+
```bash
|
|
37
|
+
RAVEN_NO_TELEMETRY=1 npm install raven-mcp
|
|
38
|
+
```
|
|
39
|
+
|
|
40
|
+
## Dependencies
|
|
41
|
+
|
|
42
|
+
### Runtime
|
|
43
|
+
| Package | Purpose | License |
|
|
44
|
+
|---------|---------|---------|
|
|
45
|
+
| `@modelcontextprotocol/sdk` | MCP protocol implementation | MIT |
|
|
46
|
+
| `zod` | Input validation | MIT |
|
|
47
|
+
|
|
48
|
+
### Dev-only (not shipped)
|
|
49
|
+
| Package | Purpose | License |
|
|
50
|
+
|---------|---------|---------|
|
|
51
|
+
| `typescript` | Build | Apache-2.0 |
|
|
52
|
+
| `tsx` | Dev server | MIT |
|
|
53
|
+
| `@types/node` | Type definitions | MIT |
|
|
54
|
+
| `resend` | Email (dev testing only) | MIT |
|
|
55
|
+
|
|
56
|
+
Zero transitive runtime dependencies beyond the two listed above.
|
|
57
|
+
|
|
58
|
+
## License
|
|
59
|
+
|
|
60
|
+
MIT — see [LICENSE](./LICENSE).
|
|
61
|
+
|
|
62
|
+
## Reporting Vulnerabilities
|
|
63
|
+
|
|
64
|
+
Email security concerns to andrew@ravenmcp.ai. Response within 48 hours.
|
|
65
|
+
|
|
66
|
+
## Enterprise / Compliance Use
|
|
67
|
+
|
|
68
|
+
For enterprise environments requiring:
|
|
69
|
+
- Telemetry disabled: set `RAVEN_NO_TELEMETRY=1`
|
|
70
|
+
- Version pinning: lock to a specific version in `package.json`
|
|
71
|
+
- SBOM: generate with `npm sbom --sbom-format cyclonedx`
|
|
72
|
+
- Audit: run `npm audit` — zero known vulnerabilities as of v1.1.0
|
|
73
|
+
|
|
74
|
+
Raven MCP is designed for local-only, air-gapped use. No network access is required after installation.
|