renovate-mcp 0.10.0 → 0.11.0

package/README.md

@@ -48,7 +48,7 @@ See [Design notes](#design-notes) for implementation details (timeouts, safety c
 - **Not a Renovate replacement.** This server doesn't open PRs, run scheduled updates, or execute in CI — it's a design-time companion for a local `renovate.json`. Use the real Renovate for the actual dependency-update pipeline.
 - **`resolve_config` is preview-quality.** Preset expansion runs against a committed snapshot, and template substitution implements only positional `{{argN}}` placeholders — non-positional tokens and Handlebars helpers are flagged in `warnings` and pass through verbatim. For authoritative output, run `dry_run`.
 - **`preview_custom_manager` is a subset of Renovate's regex manager.** It covers `customType: "regex"`, `matchStringsStrategy` of `any` / `combination` / `recursive`, and `{{groupName}}` template substitution only — other custom types and full Handlebars (helpers, conditionals) are not implemented. Use it for fast regex iteration; confirm with `dry_run`.
-- **`validate_config` / `dry_run` aren't exercised in CI.** CI deliberately doesn't install Renovate, so tools that shell out to it are only covered by unit/integration tests that don't require the binary. Run them locally against the Renovate install you intend to deploy with.
+- **`validate_config` / `dry_run` aren't exercised end-to-end in CI.** The bundled Renovate is available (it's a runtime dep), but the integration tests use fake binaries via `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` env overrides for determinism and speed. Run the tools locally against a real config to validate behaviour.
 
 ## Requirements
 
@@ -56,11 +56,12 @@ See [Design notes](#design-notes) for implementation details (timeouts, safety c
 
 - Linux or macOS. Windows is not supported — `package.json` declares `"os": ["darwin", "linux"]`, so `npm i` surfaces an `EBADPLATFORM` warning on Windows, and the server exits with a clear stderr message at startup. Run on WSL2 or a Linux/macOS host instead.
 - Node.js ≥ 24 (aligns with Renovate's own engine requirement).
-- Renovate on your `PATH` — either a global install (`npm i -g renovate`) or a project-local install that exposes `renovate` + `renovate-config-validator` via `npm exec`. Only needed for `validate_config`, `dry_run`, and `write_config`; the offline tools (`read_config`, `resolve_config`, `preview_custom_manager`, `lint_config`) work without it.
+
+Renovate ships bundled — the `renovate` package is a runtime dependency, so `validate_config`, `dry_run`, and `write_config` work out of the box with no separate install. The offline tools (`read_config`, `resolve_config`, `explain_config`, `preview_custom_manager`, `lint_config`) never spawn Renovate at all.
 
 **Optional**
 
-- `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` — override binary locations.
+- `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` — override the bundled binaries (e.g., to point at a different Renovate install). When set, the override always wins.
 - `RENOVATE_MCP_REQUIRE_CLI=false` — suppress the startup "partial availability" notice when you only intend to use the offline tools.
 - Platform env vars — `RENOVATE_PLATFORM`, `RENOVATE_ENDPOINT`, and a token (`RENOVATE_TOKEN` / `GITHUB_TOKEN` / `GITLAB_TOKEN`). Needed for `dry_run` against a remote platform and for `resolve_config` with `externalPresets: true`. See [Platform setup](#platform-setup) for the matrix and a worked example.
 - Private-registry credentials for `dry_run` — whatever Renovate itself would need at lookup time (`COMPOSER_AUTH`, `NPM_TOKEN` / `.npmrc`, Docker registry creds, or a `RENOVATE_HOST_RULES` JSON blob). Alternatively encode these as `hostRules` in the Renovate config, or pass them per-call via the `hostRules` input on `dry_run` (no MCP restart needed). Per-call `hostRules` are appended to whatever the repo's own config declares. Values reach Renovate as JSON through the tool-call transport, so the calling LLM sees them in its context — prefer the env route if that matters. Without any of these, Renovate's lookup often returns 0 updates silently; `dry_run` scans its logs for auth failures and surfaces them under `problems`.
@@ -255,6 +256,7 @@ Secrets required on the repo: `RELEASE_PLEASE_TOKEN` (a PAT for release-please).
 Scope and non-goals are summarized in [What this is NOT](#what-this-is-not); this section covers implementation decisions behind the scope that *is* supported.
 
 - `validate_config`, `dry_run`, and `write_config` shell out to the Renovate CLI rather than importing Renovate as a library — this decouples our Node version from Renovate's (currently Node 24).
+- The `renovate` package is bundled as a runtime dependency so users don't need a separate `npm i -g renovate`. We still spawn the binary as a child process (via `node node_modules/renovate/dist/renovate.js`) — never `import "renovate"` from `src/`. Resolution order is `RENOVATE_BIN` env override → bundled JS entry resolved via `require.resolve("renovate/package.json")` → bare tool name on `PATH`. The env override is the supported escape hatch when a user wants a different Renovate version.
 - `resolve_config`, `preview_custom_manager`, and `lint_config` are fully in-process and never invoke the Renovate CLI, so they work without a Renovate install.
 - `lint_config` is a semantic lint pass that sits alongside `validate_config` rather than replacing it: schema validation catches structural bugs, the linter catches Renovate-specific footguns that schema validation declares valid — most commonly a pattern like `"matchPackageNames": ["/devops\\/pipelines\\/.+"]` where a trailing `/` is missing and Renovate silently degrades the value to an exact-string match that never hits, or a typo like `"matchManagers": ["npmm"]` that silently applies the rule to zero packages. The ruleset is intentionally small (three rules: `dead-regex-missing-slash`, `unwrapped-regex`, `matchManagers-unknown-name`), scoped to the four regex-aware fields plus `matchManagers` / `excludeManagers`, and tuned to avoid false positives on benign exact strings containing a `.`. The valid-manager list is snapshotted from the `renovate` devDep at `src/data/managers.generated.ts` (regenerate with `npm run generate:managers`), and unknown names get a Damerau-Levenshtein "did you mean?" suggestion when something close enough exists. Rule IDs are stable so findings can be suppressed by callers.
 - `preview_custom_manager` honors `.gitignore` (including nested `.gitignore`s and `.git/info/exclude`) when walking the repo, so generated/vendored directories like `dist/`, `.next/`, `target/`, `__pycache__/` don't crowd out real hits against the `maxFilesWalked` cap. `node_modules/` and `.git/` are always skipped as a safety net even when no `.gitignore` is present.
@@ -274,4 +276,4 @@ Scope and non-goals are summarized in [What this is NOT](#what-this-is-not); thi
 - `dry_run` emits MCP progress notifications only when the caller's `tools/call` includes `_meta.progressToken` — no-op otherwise, so legacy clients see zero overhead. A 5-second heartbeat ticks while the child runs; each tick's message is best-effort enriched with the latest Renovate JSON-log `msg` seen on stdout. Notifications are also emitted at start and completion. We deliberately don't couple to Renovate's log schema beyond reading `msg`, since that schema isn't a stable API.
 - `dry_run_diff` is stateless on purpose: both reports are passed as inputs, no per-repo state is kept on the server. Updates are keyed by `(manager, packageFile, depName)` so a version bump on the same dep shows up once under `changed` rather than twice as `removed + added`. Compared per identity: `newValue`, `newVersion`, `updateType`, `branchName`, `groupName`, `schedule`. Either input can be the raw Renovate report or the full `dry_run` summary (with the `report` key) — the tool unwraps `report` automatically.
 - `write_config` writes to a temp file, validates, then atomically renames — so a failed validation never leaves a broken config on disk. The `force: true` escape hatch is gated behind a separate `confirmForce: "YES_OVERRIDE_VALIDATION"` literal: a single boolean is too easy for a prompt-injected agent to flip, but emitting an unusual sentinel string is a deliberate step that's harder to navigate accidentally.
-- `check_setup` and the shell-out tools (`validate_config`, `write_config`, `dry_run`) detect Renovate runtime conditions that degrade the tool silently — currently the bundled `re2` native module failing to load (typically after a Node major-version upgrade leaves a prebuilt `re2.node` compiled against the old ABI). When the WARN appears in Renovate's stderr, the tool response carries a `warnings: [{ kind: "re2-unusable", … }]` entry alongside its normal output and `check_setup` aggregates the same warning into `SetupStatus.warnings` plus the startup `instructions` banner. Renovate keeps running on JavaScript `RegExp` so calls don't fail, but regex-heavy operations (custom managers, validation, lookups) are noticeably slower; the fix hint is `cd $(npm root -g)/renovate && npm rebuild re2` (or reinstall Renovate). This is passive detection only — the server doesn't rebuild anything itself.
+- `check_setup` and the shell-out tools (`validate_config`, `write_config`, `dry_run`) detect Renovate runtime conditions that degrade the tool silently — currently the bundled `re2` native module failing to load (typically after a Node major-version upgrade leaves a prebuilt `re2.node` compiled against the old ABI). When the WARN appears in Renovate's stderr, the tool response carries a `warnings: [{ kind: "re2-unusable", … }]` entry alongside its normal output and `check_setup` aggregates the same warning into `SetupStatus.warnings` plus the startup `instructions` banner. Renovate keeps running on JavaScript `RegExp` so calls don't fail, but regex-heavy operations (custom managers, validation, lookups) are noticeably slower; the fix hint is to reinstall renovate-mcp (which reinstalls the bundled `renovate` and rebuilds its native deps), or run `npm rebuild re2` inside the renovate-mcp install's `node_modules/renovate`. This is passive detection only — the server doesn't rebuild anything itself.

package/dist/lib/renovateCli.d.ts

@@ -31,17 +31,41 @@ export interface RunOptions {
  * timeouts.
  */
 export declare function run(cmd: string, args: string[], opts?: RunOptions): Promise<RunResult>;
+export interface ResolvedRenovateTool {
+    /** Process to spawn. */
+    cmd: string;
+    /** Args prepended to the caller's args (e.g., the JS file path when `cmd` is `node`). */
+    prefixArgs: string[];
+    /** Where the binary came from — drives setup-status messaging. */
+    source: "env" | "bundled" | "path";
+    /**
+     * Raw user-visible identifier for the resolved binary. For `env` it's the
+     * env-var value (often an absolute path); for `bundled` and `path` it's the
+     * tool name. Callers compose this with `source` when rendering a label —
+     * keeping it raw avoids producing nested parens in error messages like
+     * `MISSING — <err> (<command>)`.
+     */
+    command: string;
+}
 /**
- * Resolve how to invoke a Renovate CLI tool. Users can override via env:
- *   RENOVATE_BIN                  — path to the `renovate` binary
- *   RENOVATE_CONFIG_VALIDATOR_BIN — path to the validator binary
- * Otherwise we rely on PATH resolution (globally installed Renovate, or a
- * `npm exec` from a project with Renovate installed locally).
+ * Resolve how to invoke a Renovate CLI tool. Resolution order:
+ *   1. `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` env override — if set,
+ *      always wins (even if it points at a broken path; we surface the spawn
+ *      error rather than silently falling through).
+ *   2. Bundled binary — the `renovate` package is a runtime dep, so its
+ *      `bin/renovate.js` / `bin/config-validator.js` ship with the install.
+ *      Spawned as `node <jsPath>` to sidestep shebang/permission concerns.
+ *   3. Bare tool name on `PATH` — last-resort fallback for the unusual case
+ *      where the bundled lookup fails (e.g. a corrupted node_modules). Only
+ *      manually tested; unit-testing this branch would require monkey-patching
+ *      `require.resolve` to fake a bundled-lookup failure.
  */
-export declare function resolveRenovateTool(tool: "renovate" | "renovate-config-validator"): string;
+export declare function resolveRenovateTool(tool: "renovate" | "renovate-config-validator"): ResolvedRenovateTool;
 /**
  * Centralized message for when a Renovate CLI binary can't be spawned (ENOENT,
  * permission denied, etc.). Used by all tools that shell out so users get
- * consistent, actionable hints instead of raw spawn errors.
+ * consistent, actionable hints instead of raw spawn errors. Renovate ships
+ * bundled with the server, so the most likely cause of failure here is a
+ * deliberately broken `RENOVATE_BIN` override or a corrupted install.
  */
 export declare function formatMissingBinaryError(tool: "renovate" | "renovate-config-validator", cause: Error): string;

package/dist/lib/renovateCli.js

@@ -1,5 +1,9 @@
 import { spawn } from "node:child_process";
+import { createRequire } from "node:module";
+import path from "node:path";
+import fs from "node:fs";
 import { detectRuntimeWarnings } from "./runtimeWarnings.js";
+const requireFromHere = createRequire(import.meta.url);
 /**
  * Spawn a command and capture stdout/stderr. Never throws on non-zero exit —
  * caller inspects exitCode. Throws only for spawn errors (ENOENT etc.) and
@@ -95,26 +99,66 @@ export function run(cmd, args, opts = {}) {
     });
 }
 /**
- * Resolve how to invoke a Renovate CLI tool. Users can override via env:
- *   RENOVATE_BIN                  — path to the `renovate` binary
- *   RENOVATE_CONFIG_VALIDATOR_BIN — path to the validator binary
- * Otherwise we rely on PATH resolution (globally installed Renovate, or a
- * `npm exec` from a project with Renovate installed locally).
+ * Locate the JS entry-point for one of Renovate's CLI tools inside the
+ * `renovate` npm package shipped as a runtime dep. Returns `null` if the
+ * package can't be resolved or its `bin` field doesn't list the tool —
+ * callers fall back to PATH lookup so a user with a deliberately broken
+ * `renovate` install (or an unusual install topology that hides it from
+ * `require.resolve`) still has an escape hatch.
+ */
+function resolveBundledBinary(tool) {
+    try {
+        const pkgPath = requireFromHere.resolve("renovate/package.json");
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+        const binEntry = pkg.bin?.[tool];
+        if (typeof binEntry !== "string")
+            return null;
+        const binAbs = path.join(path.dirname(pkgPath), binEntry);
+        if (!fs.existsSync(binAbs))
+            return null;
+        return binAbs;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve how to invoke a Renovate CLI tool. Resolution order:
+ *   1. `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` env override — if set,
+ *      always wins (even if it points at a broken path; we surface the spawn
+ *      error rather than silently falling through).
+ *   2. Bundled binary — the `renovate` package is a runtime dep, so its
+ *      `bin/renovate.js` / `bin/config-validator.js` ship with the install.
+ *      Spawned as `node <jsPath>` to sidestep shebang/permission concerns.
+ *   3. Bare tool name on `PATH` — last-resort fallback for the unusual case
+ *      where the bundled lookup fails (e.g. a corrupted node_modules). Only
+ *      manually tested; unit-testing this branch would require monkey-patching
+ *      `require.resolve` to fake a bundled-lookup failure.
  */
 export function resolveRenovateTool(tool) {
     const envKey = tool === "renovate" ? "RENOVATE_BIN" : "RENOVATE_CONFIG_VALIDATOR_BIN";
-    return process.env[envKey] || tool;
+    const envValue = process.env[envKey];
+    if (envValue) {
+        return { cmd: envValue, prefixArgs: [], source: "env", command: envValue };
+    }
+    const bundled = resolveBundledBinary(tool);
+    if (bundled) {
+        return { cmd: process.execPath, prefixArgs: [bundled], source: "bundled", command: tool };
+    }
+    return { cmd: tool, prefixArgs: [], source: "path", command: tool };
 }
 /**
  * Centralized message for when a Renovate CLI binary can't be spawned (ENOENT,
  * permission denied, etc.). Used by all tools that shell out so users get
- * consistent, actionable hints instead of raw spawn errors.
+ * consistent, actionable hints instead of raw spawn errors. Renovate ships
+ * bundled with the server, so the most likely cause of failure here is a
+ * deliberately broken `RENOVATE_BIN` override or a corrupted install.
  */
 export function formatMissingBinaryError(tool, cause) {
     const envKey = tool === "renovate" ? "RENOVATE_BIN" : "RENOVATE_CONFIG_VALIDATOR_BIN";
     return [
         `Failed to run \`${tool}\`: ${cause.message}.`,
-        `Install Renovate globally with \`npm i -g renovate\`, or set ${envKey} to point at an existing binary.`,
+        `Renovate ships bundled with renovate-mcp; if the bundled binary fails to load, set ${envKey} to a working binary or reinstall renovate-mcp.`,
         "Call the `check_setup` tool for a full diagnostic.",
     ].join(" ");
 }

package/dist/lib/runtimeWarnings.js

@@ -16,7 +16,7 @@
  */
 const MAX_DETAIL_LENGTH = 300;
 const MAX_WARNINGS = 10;
-const RE2_FIX_HINT = "The RE2 native module bundled with Renovate failed to load (likely after a Node version upgrade). Renovate is falling back to JavaScript `RegExp`, which is significantly slower for regex-heavy operations. To restore vectorized regex: `cd $(npm root -g)/renovate && npm rebuild re2`, or reinstall Renovate (`npm i -g renovate`). If `RENOVATE_BIN` points at a project-local install, run `npm rebuild re2` in that project instead.";
+const RE2_FIX_HINT = "The RE2 native module bundled with Renovate failed to load (likely after a Node version upgrade). Renovate is falling back to JavaScript `RegExp`, which is significantly slower for regex-heavy operations. To restore vectorized regex: reinstall renovate-mcp (which reinstalls the bundled `renovate` and rebuilds its native deps), or run `npm rebuild re2` inside the renovate-mcp install's `node_modules/renovate`. If `RENOVATE_BIN` points at a different Renovate install, run `npm rebuild re2` there instead.";
 const RE2_MESSAGE = "Renovate's RE2 native module is unusable; falling back to JavaScript `RegExp` (slower).";
 function truncate(s) {
     if (s.length <= MAX_DETAIL_LENGTH)

package/dist/lib/setupCheck.d.ts

@@ -3,6 +3,13 @@ export type RenovateBinary = "renovate" | "renovate-config-validator";
 export interface BinaryStatus {
     tool: RenovateBinary;
     command: string;
+    /**
+     * Where the resolved binary came from. `bundled` means renovate-mcp's own
+     * `node_modules/renovate` was used (the default); `env` means the user set
+     * `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN`; `path` means the bundled
+     * lookup failed and we fell through to the bare tool name on `PATH`.
+     */
+    source: "env" | "bundled" | "path";
     found: boolean;
     version?: string;
     error?: string;

package/dist/lib/setupCheck.js

@@ -2,16 +2,20 @@ import { run, resolveRenovateTool } from "./renovateCli.js";
 import { dedupeRuntimeWarnings } from "./runtimeWarnings.js";
 const DRY_RUN_PLATFORMS = ["local", "github", "gitlab"];
 const VERSION_TIMEOUT_MS = 10_000;
-const INSTALL_HINT = "Install Renovate globally with `npm i -g renovate`, or set RENOVATE_BIN / RENOVATE_CONFIG_VALIDATOR_BIN to existing binaries.";
+const INSTALL_HINT = "Renovate ships bundled with renovate-mcp; if that fails to load, set RENOVATE_BIN / RENOVATE_CONFIG_VALIDATOR_BIN to a working binary or reinstall renovate-mcp.";
 async function checkBinary(tool) {
-    const command = resolveRenovateTool(tool);
+    const resolved = resolveRenovateTool(tool);
+    const command = resolved.command;
     try {
-        const result = await run(command, ["--version"], { timeoutMs: VERSION_TIMEOUT_MS });
+        const result = await run(resolved.cmd, [...resolved.prefixArgs, "--version"], {
+            timeoutMs: VERSION_TIMEOUT_MS,
+        });
         const runtimeWarnings = result.runtimeWarnings.length ? result.runtimeWarnings : undefined;
         if (result.exitCode !== 0) {
             return {
                 tool,
                 command,
+                source: resolved.source,
                 found: false,
                 error: (result.stderr || result.stdout).trim() || `exit code ${result.exitCode}`,
                 runtimeWarnings,
@@ -20,6 +24,7 @@ async function checkBinary(tool) {
         return {
             tool,
             command,
+            source: resolved.source,
             found: true,
             version: result.stdout.trim() || undefined,
             runtimeWarnings,
@@ -29,6 +34,7 @@ async function checkBinary(tool) {
         return {
             tool,
             command,
+            source: resolved.source,
             found: false,
             error: err.message,
         };
@@ -160,9 +166,9 @@ export function startupBanner(status) {
         const offlineList = OFFLINE_TOOLS.map((n) => `\`${n}\``).join(", ");
         sections.push([
             "Partial availability:",
-            `  Renovate CLI not found — only blocks: ${unavailList}.`,
+            `  Renovate CLI not reachable — only blocks: ${unavailList}.`,
             `  Offline tools (${offlineList}) still work; do not flag this as a setup problem when the task only needs those.`,
-            "  Install Renovate (`npm i -g renovate`) before calling the blocked tools, or call `check_setup` for a full diagnostic.",
+            "  Renovate ships bundled with renovate-mcp; if you see this banner, the bundled binary failed to spawn or `RENOVATE_BIN` / `RENOVATE_CONFIG_VALIDATOR_BIN` points at a broken binary. Call `check_setup` for a full diagnostic.",
             "  Set `RENOVATE_MCP_REQUIRE_CLI=false` to suppress this notice if you have consciously chosen the offline subset.",
         ].join("\n"));
     }
@@ -222,7 +228,14 @@ export function describeSetup(status) {
     return lines.join("\n");
 }
 function formatBinary(s) {
-    if (s.found)
-        return `${s.version ?? "(version unknown)"} (${s.command})`;
-    return `MISSING — ${s.error ?? "unknown error"}`;
+    if (s.found) {
+        const version = s.version ?? "(version unknown)";
+        if (s.source === "bundled")
+            return `${version} (bundled)`;
+        const prefix = s.source === "env" ? "env" : "PATH";
+        return `${version} (${prefix}: ${s.command})`;
+    }
+    if (s.source === "bundled")
+        return `MISSING — ${s.error ?? "unknown error"} (bundled)`;
+    return `MISSING — ${s.error ?? "unknown error"} (${s.command})`;
 }

package/dist/lib/version.d.ts

@@ -1,4 +1,4 @@
-export declare const SERVER_VERSION = "0.10.0";
+export declare const SERVER_VERSION = "0.11.0";
 export type BuildMode = "local" | "released";
 export interface VersionInfo {
     version: string;

package/dist/lib/version.js

@@ -1,5 +1,5 @@
 import { fileURLToPath } from "node:url";
-export const SERVER_VERSION = "0.10.0"; // x-release-please-version
+export const SERVER_VERSION = "0.11.0"; // x-release-please-version
 // "released" = the server is running from a `node_modules/` install (global
 // `npm i -g`, project-local `npm i`, or `npx renovate-mcp`). Anything else —
 // most commonly an MCP config of `{"command": "node", "args": [".../dist/index.js"]}`

package/dist/tools/dryRun.js

@@ -132,7 +132,7 @@ export function registerDryRun(server) {
             }
         }
         const reportPath = path.join(tmpdir(), `renovate-mcp-report-${randomUUID()}.json`);
-        const bin = resolveRenovateTool("renovate");
+        const tool = resolveRenovateTool("renovate");
         const ruleList = hostRules ?? [];
         // When the caller doesn't pass `platform`, fall back to RENOVATE_PLATFORM
         // from the MCP server's env before defaulting to `local`. Without this,
@@ -291,7 +291,7 @@ export function registerDryRun(server) {
                 emit(`Starting Renovate dry-run (${dryRunMode})`);
                 heartbeat = setInterval(() => emit(buildDryRunHeartbeatMessage(Date.now() - startedAt, lastLogMsg)), HEARTBEAT_MS);
             }
-            const result = await run(bin, args, {
+            const result = await run(tool.cmd, [...tool.prefixArgs, ...args], {
                 cwd: repoPath,
                 env: childEnv,
                 timeoutMs,

package/dist/tools/validateConfig.js

@@ -37,12 +37,12 @@ export function registerValidateConfig(server) {
             };
         }
         try {
-            const bin = resolveRenovateTool("renovate-config-validator");
+            const tool = resolveRenovateTool("renovate-config-validator");
             const args = [];
             if (strict)
                 args.push("--strict");
             args.push(target);
-            const result = await run(bin, args, { timeoutMs: 30_000 });
+            const result = await run(tool.cmd, [...tool.prefixArgs, ...args], { timeoutMs: 30_000 });
             const valid = result.exitCode === 0;
             const output = (result.stdout + result.stderr).trim();
             const payload = { valid, output };

package/dist/tools/writeConfig.js

@@ -86,8 +86,8 @@ export function registerWriteConfig(server) {
             let validatorMissing = false;
             let runtimeWarnings = [];
             try {
-                const bin = resolveRenovateTool("renovate-config-validator");
-                const v = await run(bin, [tmp], { timeoutMs: 30_000 });
+                const tool = resolveRenovateTool("renovate-config-validator");
+                const v = await run(tool.cmd, [...tool.prefixArgs, tmp], { timeoutMs: 30_000 });
                 validationOutput = (v.stdout + v.stderr).trim();
                 valid = v.exitCode === 0;
                 runtimeWarnings = v.runtimeWarnings;
@@ -102,7 +102,7 @@ export function registerWriteConfig(server) {
                     reason: validatorMissing ? "validator-unavailable" : "validation-failed",
                     validationOutput,
                     hint: validatorMissing
-                        ? "Install renovate-config-validator (or set RENOVATE_CONFIG_VALIDATOR_BIN), then retry. Pass force=true to skip validation entirely."
+                        ? "The bundled renovate-config-validator failed to spawn. Set RENOVATE_CONFIG_VALIDATOR_BIN to a working binary or reinstall renovate-mcp, then retry. Pass force=true to skip validation entirely."
                         : "Pass force=true to write anyway.",
                 };
                 if (runtimeWarnings.length > 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "renovate-mcp",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "MCP server for designing Renovate configurations interactively.",
   "type": "module",
   "bin": {
@@ -59,12 +59,17 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "ignore": "^7.0.5",
     "json5": "^2.2.3",
+    "renovate": "^43.139.5",
     "zod": "^4.0.0"
   },
+  "overrides": {
+    "fast-uri": "^3.1.2",
+    "fast-xml-builder": "^1.1.7",
+    "simple-git": "^3.36.0"
+  },
   "devDependencies": {
     "@types/node": "^24.0.0",
     "@vitest/coverage-v8": "^4.1.0",
-    "renovate": "^43.139.5",
     "typescript": "^6.0.0",
     "vitest": "^4.1.0"
   },