@graneth/mcp-server - npm Package Compare versions

Comparing version

0.7.0

0.7.1

+2

-1

dist/index.js

		@@ -323,2 +323,3 @@ #!/usr/bin/env node
		};
		var ECOSYSTEMS = Object.keys(REGISTRY_CLIENTS);
		async function packageExists(pkg, ecosystem) {
		@@ -1298,3 +1299,3 @@ try {
		// src/index.ts
		var VERSION = "0.7.0";
		var VERSION = "0.7.1";
		function requireObject(args) {
		@@ -1301,0 +1302,0 @@ if (!args \|\| typeof args !== "object" \|\| Array.isArray(args)) {

+10

-1

package.json

		{
		"name": "@graneth/mcp-server",
		"version": "0.7.0",
		"version": "0.7.1",
		"mcpName": "com.graneth/mcp-server",
		"description": "Account-free MCP server: catch AI-hallucinated packages (npm, PyPI, crates.io, RubyGems, Go, Packagist), risk-score the dependencies an AI agent introduces, and find hardcoded secrets before you commit. Exposes the free pre_flight_check tool over stdio.",
		"type": "module",
		"repository": {
		"type": "git",
		"url": "git+https://github.com/zubovartemiy/graneth-mcp.git",
		"directory": "packages/mcp-server"
		},
		"homepage": "https://graneth.com/docs",
		"bugs": {
		"url": "https://github.com/zubovartemiy/graneth-mcp/issues"
		},
		"bin": {
		@@ -8,0 +17,0 @@ "graneth-mcp-server": "dist/index.js"

+22

-16

README.md

		@@ -123,22 +123,28 @@ # @graneth/mcp-server
		This server shares its detection core with the hosted
		[Graneth](https://github.com/zubovartemiy/graneth-dashboard) scanner via the internal `@graneth/core-checks`
		module, so local pre-flight results match what the full PR scan would find.
		[Graneth](https://graneth.com) scanner via the `@graneth/core-checks` module —
		published in full alongside this package at
		[zubovartemiy/graneth-mcp](https://github.com/zubovartemiy/graneth-mcp) — so
		local pre-flight results match what the full PR scan would find.

		## Releasing (maintainers)
		## How this package is released

		One command, from the repo root:
		The release script itself lives in the private monorepo, not in this tree — but
		what it refuses to do is worth stating, because it is the reason a
		supply-chain tool can be trusted with its own supply chain. Every step fails
		CLOSED:

		```bash
		pnpm release:mcp # every guard, then publish (asks for the 2FA OTP)
		pnpm release:mcp --dry-run # everything except the upload
		```
		1. the monorepo's root manifest must still be `private:true`;
		2. the package being released must be exactly `@graneth/mcp-server`;
		3. branch `master`, clean working tree;
		4. the bundled threat-feed snapshot is refreshed first — a changed snapshot
		stops the release until its diff is reviewed and committed;
		5. the tarball's file list is checked against a hard allowlist — one file
		outside `dist/`, `README.md`, `LICENSE`, `package.json` aborts the publish;
		6. the public mirror you are reading must match the tree being released,
		compared file by file, so the `repository` link cannot point at older code
		than the package.

		`scripts/release-mcp.mjs` fails CLOSED on each step: root manifest must still
		be `private:true`; the package must be exactly `@graneth/mcp-server`; branch
		master + clean tree; the bundled threat-feed snapshot is refreshed (a changed
		snapshot stops the release until its diff is reviewed and committed); and the
		tarball file list is verified against a hard allowlist — one file outside
		`dist/`, `README.md`, `LICENSE`, `package.json` aborts the publish. That last
		guard is what makes "accidentally release the whole repository" structurally
		impossible, not just unlikely.
		Guard 5 is what makes "accidentally publish the whole repository" structurally
		impossible rather than merely unlikely — this project has the incident that
		taught it.

		@@ -145,0 +151,0 @@ ## License

@graneth/mcp-server - npm Package Compare versions

Fixed alerts

Improved metrics